You've already forked ansible-linux-infra
61 lines
1.5 KiB
YAML
61 lines
1.5 KiB
YAML
---
|
|
- name: Include OS-family-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "default.yml"
|
|
tags: [logging_rsyslog, always]
|
|
|
|
- name: Install rsyslog with TLS support
|
|
ansible.builtin.package:
|
|
name:
|
|
- rsyslog
|
|
- rsyslog-gnutls
|
|
state: present
|
|
when: syslog_use_tls | bool
|
|
tags: [logging_rsyslog]
|
|
|
|
- name: Install rsyslog without TLS support
|
|
ansible.builtin.package:
|
|
name: rsyslog
|
|
state: present
|
|
when: not syslog_use_tls | bool
|
|
tags: [logging_rsyslog]
|
|
|
|
- name: Distribute internal CA certificate for SIEM TLS connection
|
|
ansible.builtin.copy:
|
|
src: "{{ syslog_ca_cert_src }}"
|
|
dest: "{{ logging_rsyslog_ca_cert_dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: syslog_ca_cert_enabled | bool
|
|
notify: update CA trust
|
|
tags: [logging_rsyslog]
|
|
|
|
- name: Deploy forwarding configuration
|
|
ansible.builtin.template:
|
|
src: 60-forward-siem.conf.j2
|
|
dest: /etc/rsyslog.d/60-forward-siem.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart rsyslog
|
|
tags: [logging_rsyslog]
|
|
|
|
- name: Deploy logrotate configuration
|
|
ansible.builtin.template:
|
|
src: logrotate-cis.j2
|
|
dest: /etc/logrotate.d/rsyslog-cis
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
tags: [logging_rsyslog]
|
|
|
|
- name: Enable and start rsyslog
|
|
ansible.builtin.systemd:
|
|
name: rsyslog
|
|
enabled: true
|
|
state: started
|
|
tags: [logging_rsyslog]
|