blob: 7a40bb9584e9fdb88936a062d6cbcc9cd02cb55c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
---
- name: Install Apache modules to support dockerized elk
apache2_module: name={{ item }}
with_items:
- proxy
- proxy_http
- auth_basic
- authz_user
- authnz_ldap # apache-auth enables, also just ldap
- authnz_external
- ssl
# This controls images available on the system since
# we don't allow docker_container to do its own pulls
- name: Ensure certs dir exists
file: path=/srv/certs state=directory
- name: Copy logstash certs
copy:
src: "{{item}}"
dest: /srv/certs
with_items:
- "{{logstash_cert_path}}"
- "{{logstash_cert_private_path}}"
- name: Copy logstash conf
copy:
src: files/
dest: "{{elk_root}}"
owner: 1000
group: 1000
mode: 0600
# TODO: create custom linaro image to incorporate fix
# for CVE-2021-44228
# yum install zip
# zip -q -d /usr/share/logstash/logstash-core/lib/jars/log4j-core-*.jar \
# org/apache/logging/log4j/core/lookup/JndiLookup.class
- name: Create docker container
docker_container:
name: "{{docker_container_logstash_name}}"
image: "{{docker_image}}"
state: started
log_driver: journald
restart_policy: unless-stopped
published_ports:
- "{{docker_port_logstash}}:5044"
recreate: yes
networks:
- name: "{{ es_network_name }}"
volumes:
- "{{elk_root}}:/usr/share/logstash/pipeline/"
- "{{docker_logstash_cert}}:/etc/pki/tls/certs/logstash-beats.crt"
- "{{docker_logstash_cert_private}}:/etc/pki/tls/private/logstash-beats.key"
- name: Wait for docker to start
wait_for:
host: "{{docker_container_logstash_name}}"
port: "{{docker_port_logstash}}"
delay: 10
|
