57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
---
|
|
# Ships the whole journal to VictoriaLogs. The uploader keeps the cursor of the last uploaded
|
|
# entry in its state directory, so a restart resumes where it stopped.
|
|
- name: Require the endpoint and the credential
|
|
ansible.builtin.assert:
|
|
that:
|
|
- journal_upload.host | length > 0
|
|
- journal_upload.addresses | length > 0
|
|
- journal_upload.user | length > 0
|
|
- journal_upload.password | length > 0
|
|
fail_msg: journal_upload.host, addresses, user and password must be set
|
|
|
|
- name: Install the journal uploader
|
|
ansible.builtin.apt:
|
|
name: systemd-journal-remote
|
|
install_recommends: false
|
|
state: present
|
|
|
|
- name: Pin the ingest name to the NetBird addresses
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/hosts
|
|
marker: "# {mark} journal_upload"
|
|
block: |
|
|
{% for address in journal_upload.addresses %}
|
|
{{ address }} {{ journal_upload.host }}
|
|
{% endfor %}
|
|
notify: Restart systemd-journal-upload
|
|
|
|
- name: Create the uploader config directory
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/journal-upload.conf.d
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
# The service runs as a dynamic user, which reads the file after the manager dropped privileges.
|
|
- name: Configure the upload URL
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/journal-upload.conf.d/10-victorialogs.conf
|
|
mode: "0644"
|
|
content: |
|
|
[Upload]
|
|
URL=https://{{ journal_upload.user }}:{{ journal_upload.password }}@{{ journal_upload.host }}{{ journal_upload.path }}
|
|
# No client certificate; the server certificate is checked against the system CAs.
|
|
ServerKeyFile=-
|
|
ServerCertificateFile=-
|
|
TrustedCertificateFile=/etc/ssl/certs/ca-certificates.crt
|
|
notify: Restart systemd-journal-upload
|
|
no_log: true
|
|
|
|
- name: Enable the journal uploader
|
|
ansible.builtin.systemd:
|
|
name: systemd-journal-upload
|
|
enabled: true
|
|
state: started
|
|
# Check mode does not install the package.
|
|
ignore_errors: "{{ ansible_check_mode }}"
|