From d26651a4321fa87aea60ff15626e73a41669c892 Mon Sep 17 00:00:00 2001 From: Daniel Allaire Date: Sat, 4 Jul 2026 20:32:05 -0400 Subject: [PATCH] =?UTF-8?q?Z=C3=A9ro-confiance=20:=20IcingaDB=E2=86=92PG?= =?UTF-8?q?=20en=20TLS=20v=C3=A9rifi=C3=A9=20(cert=20step-ca)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit config.yml database : tls: true + ca: root_ca step-ca. root_ca déjà 0644 (fix client_pki). Prouvé sur sup-01 : icingadb actif, log 'pgsql+tls://', aucune erreur TLS. 3e et dernier client BD sur verify-full. Co-Authored-By: Claude Opus 4.8 --- roles/serveur_icinga/defaults/main.yml | 5 +++++ roles/serveur_icinga/templates/config.yml.j2 | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/roles/serveur_icinga/defaults/main.yml b/roles/serveur_icinga/defaults/main.yml index 5c547eb..724e1f8 100644 --- a/roles/serveur_icinga/defaults/main.yml +++ b/roles/serveur_icinga/defaults/main.yml @@ -26,3 +26,8 @@ serveur_icinga_redis_port: 6380 serveur_icinga_config: "/etc/icingadb/config.yml" serveur_icinga_schema: "/usr/share/icingadb/schema/pgsql/schema.sql" + +# TLS vers PostgreSQL (zero-confiance). true = IcingaDB verifie le cert serveur +# contre le root_ca step-ca (host dans le SAN). root_ca doit etre lisible (0644). +serveur_icinga_db_tls: false +serveur_icinga_db_ca: "/etc/step/certs/root_ca.crt" diff --git a/roles/serveur_icinga/templates/config.yml.j2 b/roles/serveur_icinga/templates/config.yml.j2 index c2645a4..f61535e 100644 --- a/roles/serveur_icinga/templates/config.yml.j2 +++ b/roles/serveur_icinga/templates/config.yml.j2 @@ -5,6 +5,10 @@ database: database: {{ serveur_icinga_entree.base }} user: {{ serveur_icinga_entree.proprietaire }} password: {{ serveur_icinga_db_password }} +{% if serveur_icinga_db_tls | default(false) %} + tls: true + ca: {{ serveur_icinga_db_ca }} +{% endif %} redis: host: {{ serveur_icinga_redis_host }}