72 lines
1.9 KiB
YAML
72 lines
1.9 KiB
YAML
# FIXME: cluster
|
|
# FIXME: BdD PostgreSQL
|
|
# FIXME: sudo cscli console enroll cmmszy92r000402l1kugvmw76
|
|
# FIXME: AppSec
|
|
|
|
- name: Add Crowdsec repository
|
|
ansible.builtin.deb822_repository:
|
|
name: "crowdsec"
|
|
uris: "https://packagecloud.io/crowdsec/crowdsec/any/"
|
|
suites: "any"
|
|
components: "main"
|
|
signed_by: "https://packagecloud.io/crowdsec/crowdsec/gpgkey"
|
|
|
|
- name: Install Crowdsec Security Engine
|
|
ansible.builtin.apt:
|
|
name:
|
|
- "crowdsec"
|
|
- "jq"
|
|
update_cache: true
|
|
notify:
|
|
- "Restart Crowdsec Securiy Engine"
|
|
|
|
- name: Configure Crowdsec
|
|
ansible.builtin.template:
|
|
src: "templates/config.yaml"
|
|
dest: "/etc/crowdsec/config.yaml"
|
|
mode: "0600"
|
|
notify:
|
|
- "Restart Crowdsec Securiy Engine"
|
|
|
|
- name: Enable and start Crowdsec Securiy Engine
|
|
ansible.builtin.systemd_service:
|
|
name: "crowdsec"
|
|
state: "started"
|
|
enabled: true
|
|
|
|
- name: Get collections list
|
|
ansible.builtin.shell:
|
|
executable: "/usr/bin/bash"
|
|
cmd: |
|
|
set -o pipefail
|
|
cscli collection list --output=json |jq -r '.collections[] |.name'
|
|
register: "crowdsec_out_list_collections"
|
|
changed_when: false
|
|
|
|
- name: Install collections
|
|
loop: "{{ crowdsec_collections }}"
|
|
when: "item not in crowdsec_out_list_collections.stdout_lines"
|
|
ansible.builtin.command:
|
|
cmd: "cscli collections install {{ item }}"
|
|
changed_when: true
|
|
notify:
|
|
- "Restart Crowdsec Securiy Engine"
|
|
|
|
- name: Get bouncers list
|
|
ansible.builtin.shell:
|
|
executable: "/usr/bin/bash"
|
|
cmd: |
|
|
set -o pipefail
|
|
cscli bouncers list --output=json |jq -r '.[] |.name'
|
|
register: "crowdsec_out_list_bouncers"
|
|
changed_when: false
|
|
|
|
- name: Create bouncers API keys
|
|
loop: "{{ crowdsec_bouncers }}"
|
|
when: "item.name not in crowdsec_out_list_bouncers.stdout_lines"
|
|
ansible.builtin.command:
|
|
cmd: "cscli bouncers add {{ item.name }} --key '{{ item.key }}'"
|
|
changed_when: true
|
|
notify:
|
|
- "Restart Crowdsec Securiy Engine"
|