initial commit

roles/logging_rsyslog/tasks/main.yml

@@ -0,0 +1,60 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [logging_rsyslog, always]
+
+- name: Install rsyslog with TLS support
+  ansible.builtin.package:
+    name:
+      - rsyslog
+      - rsyslog-gnutls
+    state: present
+  when: syslog_use_tls | bool
+  tags: [logging_rsyslog]
+
+- name: Install rsyslog without TLS support
+  ansible.builtin.package:
+    name: rsyslog
+    state: present
+  when: not syslog_use_tls | bool
+  tags: [logging_rsyslog]
+
+- name: Distribute internal CA certificate for SIEM TLS connection
+  ansible.builtin.copy:
+    src: "{{ syslog_ca_cert_src }}"
+    dest: "{{ logging_rsyslog_ca_cert_dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: syslog_ca_cert_enabled | bool
+  notify: update CA trust
+  tags: [logging_rsyslog]
+
+- name: Deploy forwarding configuration
+  ansible.builtin.template:
+    src: 60-forward-siem.conf.j2
+    dest: /etc/rsyslog.d/60-forward-siem.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart rsyslog
+  tags: [logging_rsyslog]
+
+- name: Deploy logrotate configuration
+  ansible.builtin.template:
+    src: logrotate-cis.j2
+    dest: /etc/logrotate.d/rsyslog-cis
+    owner: root
+    group: root
+    mode: "0644"
+  tags: [logging_rsyslog]
+
+- name: Enable and start rsyslog
+  ansible.builtin.systemd:
+    name: rsyslog
+    enabled: true
+    state: started
+  tags: [logging_rsyslog]