79 lines
1.9 KiB
YAML
79 lines
1.9 KiB
YAML
---
|
|
- name: Create data directories
|
|
ansible.builtin.file:
|
|
dest: "{{ item }}"
|
|
state: directory
|
|
mode: "0750"
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
with_items:
|
|
- /export/log
|
|
- /export/log/archive
|
|
|
|
- name: Link data directory
|
|
ansible.builtin.file:
|
|
dest: /srv/log
|
|
src: /export/log
|
|
state: link
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
|
|
- name: Copy server key
|
|
ansible.builtin.copy:
|
|
dest: "{{ tls_private }}/0.0.0.0:6514.key"
|
|
src: /srv/letsencrypt/live/loghost.foo.sh/privkey.pem
|
|
mode: "0600"
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
notify: Restart syslogd
|
|
tags: certificates
|
|
|
|
- name: Copy server crt
|
|
ansible.builtin.copy:
|
|
dest: "{{ tls_certs }}/0.0.0.0:6514.crt"
|
|
src: /srv/letsencrypt/live/loghost.foo.sh/fullchain.pem
|
|
mode: "0644"
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
notify: Restart syslogd
|
|
tags: certificates
|
|
|
|
- name: Add archiving to syslog.conf
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/syslog.conf
|
|
insertbefore: BOF
|
|
block: |
|
|
# everything goes to archive
|
|
*.* /srv/log/all.log
|
|
# only local goes to the standard logs
|
|
+{{ ansible_hostname }}
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK (syslogd)"
|
|
notify: Restart syslogd
|
|
|
|
- name: Create dummy all.log
|
|
ansible.builtin.shell:
|
|
cmd: umask 027 ; touch /srv/log/all.log
|
|
creates: /srv/log/all.log
|
|
|
|
- name: Install log archiver
|
|
ansible.builtin.copy:
|
|
dest: /usr/local/sbin/syslog-archive
|
|
src: syslog-archive.sh
|
|
mode: "0755"
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
|
|
- name: Install log archiver cron
|
|
ansible.builtin.cron:
|
|
name: syslog-archive
|
|
user: root
|
|
hour: "0"
|
|
minute: "0"
|
|
job: /usr/local/sbin/syslog-archive
|
|
|
|
- name: Enable syslogd remote logging
|
|
ansible.builtin.service:
|
|
name: syslogd
|
|
state: started
|
|
enabled: true
|
|
arguments: -n -K {{ tls_certs }}/ca.crt -S 0.0.0.0:6514 -S ::::6514
|