75 lines
2.7 KiB
YAML
75 lines
2.7 KiB
YAML
---
|
|
# Custom user implies multiple changes and requires additional parameters to be set
|
|
|
|
- name: "Custom user : Service group presence"
|
|
# Create a group for custom user
|
|
become: true
|
|
notify: Service restart
|
|
ansible.builtin.group:
|
|
name: "{{ agent_service_group }}"
|
|
gid: "{{ agent_service_gid | default(omit) }}"
|
|
state: present
|
|
tags: [deploy]
|
|
|
|
- name: "Custom user : Service user presence"
|
|
become: true
|
|
notify: Service restart
|
|
ansible.builtin.user:
|
|
name: "{{ agent_service_user }}"
|
|
group: "{{ agent_service_group }}"
|
|
uid: "{{ agent_service_uid | default(omit) }}"
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
home: "{{ agent_service_user_home }}"
|
|
create_home: true
|
|
state: present
|
|
tags: [deploy]
|
|
|
|
- name: "Custom user : Separate Log folder & permissions"
|
|
# Custom user requires custom folder ownership to manage logs(create/write/rotate)
|
|
become: true
|
|
notify: Service restart
|
|
ansible.builtin.file:
|
|
path: "{{ item.folder | dirname }}"
|
|
state: directory
|
|
owner: "{{ agent_service_user }}"
|
|
group: "{{ agent_service_group }}"
|
|
setype: "{{ item.setype }}"
|
|
recurse: true
|
|
loop: "{{ agent_internal_file_loop | select }}"
|
|
vars:
|
|
agent_internal_file_loop:
|
|
- { folder: "{{ agent_param_logfile | default(None) }}", setype: "{{ agent_folder_log_setype | default(None) }}" }
|
|
# - {folder: '{{ agent_param_pidfile | default(None) }}', setype: '{{ agent_folder_pid_setype | default(None) }}'}
|
|
tags: [deploy]
|
|
|
|
- name: "Custom user : Systemd : Custom user override in service file"
|
|
# changing user requires to change permissions on pid file and folder.
|
|
#
|
|
# currently packages use not the best approach to manage pid location by setting all at: /usr/lib/tmpfiles.d/zabbix-agent.conf
|
|
# which creates folder on systemd start even with agentd service disabled. (subject to change in future)
|
|
#
|
|
# to avoid conflict with different zabbix components we are changing location only for current service at systemd level in unit zabbix_agent.service file.
|
|
# which is done using overrides at etc, instead of changes on tmpfs mount.
|
|
#
|
|
# same applies to log file and folder
|
|
become: true
|
|
notify:
|
|
- Reload systemd daemon
|
|
- Service restart
|
|
ansible.builtin.blockinfile:
|
|
path: "{{ agent_systemd_override_path }}"
|
|
marker: "###<!-- {mark} ansible managed block -->##"
|
|
block: |
|
|
[Service]
|
|
User={{ agent_service_user }}
|
|
Group={{ agent_service_group }}
|
|
RuntimeDirectory={{ agent_binary_name }}
|
|
PIDFile={{ agent_param_pidfile }}
|
|
state: present
|
|
create: true
|
|
mode: "{{ agent_conf_file.folder_permissions.mode }}"
|
|
owner: "{{ agent_conf_file.permissions.user }}"
|
|
group: "{{ agent_conf_file.permissions.group }}"
|
|
tags: [deploy, config]
|