Daniel Allaire
660aee91fa
Loki sert son API en HTTPS via le cert step-ca (http_tls_config + cert-sync owned loki, motif .path). Alloy pousse en https + tls_config (ca=root_ca). Vars : serveur_loki_tls_actif, client_journal_loki_tls. Prouvé : Loki HTTPS /ready 200 (vérif root_ca), HTTP rejeté (400), 4 hôtes expédient des logs en https, 0 erreur loki.write après la transition. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
135 lines
3.6 KiB
YAML
135 lines
3.6 KiB
YAML
---
|
|
- name: Assurer le repertoire des trousseaux apt
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Telecharger la cle de signature Grafana
|
|
ansible.builtin.get_url:
|
|
url: "{{ serveur_loki_depot_cle_url }}"
|
|
dest: "{{ serveur_loki_depot_cle_fichier }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Ajouter le depot apt Grafana
|
|
ansible.builtin.apt_repository:
|
|
repo: "{{ serveur_loki_depot_source }}"
|
|
filename: grafana
|
|
state: present
|
|
|
|
- name: Installer Loki
|
|
ansible.builtin.apt:
|
|
name: "{{ serveur_loki_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Assurer le groupe loki (le paquet cree l'utilisateur en nogroup)
|
|
ansible.builtin.group:
|
|
name: loki
|
|
system: true
|
|
|
|
- name: Rattacher l'utilisateur loki a son groupe
|
|
ansible.builtin.user:
|
|
name: loki
|
|
group: loki
|
|
|
|
- name: Assurer le repertoire de donnees Loki
|
|
ansible.builtin.file:
|
|
path: "{{ serveur_loki_chemin }}"
|
|
state: directory
|
|
owner: loki
|
|
group: loki
|
|
mode: "0750"
|
|
|
|
# --- TLS : synchroniser le cert step_ca AVANT d'activer http_tls_config ---
|
|
- name: TLS — repertoire des certificats (loki)
|
|
ansible.builtin.file:
|
|
path: "{{ serveur_loki_tls_dir }}"
|
|
state: directory
|
|
owner: loki
|
|
group: loki
|
|
mode: "0700"
|
|
when: serveur_loki_tls_actif | bool
|
|
|
|
- name: TLS — script de synchronisation du certificat
|
|
ansible.builtin.template:
|
|
src: setops-loki-cert-sync.sh.j2
|
|
dest: /usr/local/sbin/setops-loki-cert-sync
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when: serveur_loki_tls_actif | bool
|
|
|
|
- name: TLS — unites de synchronisation (service + path)
|
|
ansible.builtin.template:
|
|
src: "{{ item.s }}"
|
|
dest: "{{ item.d }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- { s: "setops-loki-cert-sync.service.j2", d: "/etc/systemd/system/setops-loki-cert-sync.service" }
|
|
- { s: "setops-loki-cert-sync.path.j2", d: "/etc/systemd/system/setops-loki-cert-sync.path" }
|
|
loop_control:
|
|
label: "{{ item.d | basename }}"
|
|
when: serveur_loki_tls_actif | bool
|
|
|
|
- name: TLS — activer la surveillance du certificat (path)
|
|
ansible.builtin.systemd:
|
|
name: setops-loki-cert-sync.path
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
when:
|
|
- serveur_loki_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: TLS — synchroniser le certificat maintenant
|
|
ansible.builtin.command: /usr/local/sbin/setops-loki-cert-sync
|
|
changed_when: false
|
|
when:
|
|
- serveur_loki_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: TLS — verifier la presence du certificat synchronise
|
|
ansible.builtin.stat:
|
|
path: "{{ serveur_loki_tls_dir }}/{{ item }}"
|
|
register: serveur_loki_tls_stat
|
|
loop:
|
|
- loki.crt
|
|
- loki.key
|
|
when:
|
|
- serveur_loki_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: TLS — garde-fou, ne pas activer sans certificat en place
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.stat.exists
|
|
fail_msg: "Cert Loki absent ({{ item.item }}) — TLS non active."
|
|
loop: "{{ serveur_loki_tls_stat.results | default([]) }}"
|
|
loop_control:
|
|
label: "{{ item.item }}"
|
|
when:
|
|
- serveur_loki_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Deployer la configuration Loki
|
|
ansible.builtin.template:
|
|
src: config.yml.j2
|
|
dest: "{{ serveur_loki_config }}"
|
|
owner: root
|
|
group: loki
|
|
mode: "0640"
|
|
notify: Redemarrer loki
|
|
|
|
- name: Activer et demarrer Loki
|
|
when: not ansible_check_mode
|
|
ansible.builtin.systemd:
|
|
name: "{{ serveur_loki_service }}"
|
|
enabled: true
|
|
state: started
|