71968 fluent bit role pr devel 2.x

roles/_meta/common_base/meta/main.yml

@@ -37,7 +37,7 @@ dependencies:
     when: is_local is not defined or not is_local
   - role: debian/rkhunter
     when: is_local is not defined or not is_local
-  - role: debian/rsyslog
+  - role: debian/fluent-bit
   - role: debian/postfix
   - role: debian/clamav
     when: is_local is not defined or not is_local

roles/debian/fluent-bit/README.md

@@ -0,0 +1,66 @@
+# Fluent-bit
+
+## Description
+
+Deploy [Fluent-bit](https://github.com/fluent/fluent-bit) using ansible.
+
+### Requirements
+
+Role expects to be provided with the following information:
+* `fluentbit_main_config` - the main Fluent-bit configuration
+
+### Example
+Minimum Fluent-bit config that will send a test log, filter it, and output to stdout.
+
+```yaml
+fluentbit_main_config:
+  service:
+    flush: 5
+    log_level: info
+
+parsers:
+    - name: json
+      format: json
+      time_key: time
+      time_format: '%d/%b/%Y:%H:%M:%S %z'
+
+  pipeline:
+    inputs:
+        - name: dummy
+          dummy: '{"endpoint":"localhost", "value":"something"}'
+          tag: dummy
+    filters:
+        - name: grep
+          match: '*'
+          logical_op: or
+          regex:
+            - value something
+            - value error
+    outputs:
+        - name: stdout
+
+```
+
+For more details on setting up the Fluent-bit config, refer to official documentation:
+https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bitexporter
+
+<!--TOC-->
+<!--ENDTOC-->
+
+<!--ROLEVARS-->
+## Default variables
+```yaml
+---
+# Default variables for Fluent-bit role
+# Construct the download URL using the version variable.
+fluent_bit_repo_key_url: https://packages.fluentbit.io/fluentbit.key
+fluent_bit_key_location: /usr/share/keyrings/fluentbit-keyring.asc
+fluent_bit_apt_source: "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.asc] https://packages.fluentbit.io/debian/{{ ansible_distribution_release }} {{ ansible_distribution_release }} main"
+fluent_bit_startup_command: /opt/fluent-bit/bin/fluent-bit -c /etc/fluent-bit/fluent-bit.yml
+
+# fluent-bit configuration
+fluentbit_main_config: {}
+# Example config
+```
+
+<!--ENDROLEVARS-->

roles/debian/fluent-bit/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+# Default variables for Fluent-bit role
+fluent_bit_repo_key_url: https://packages.fluentbit.io/fluentbit.key
+fluent_bit_key_location: /usr/share/keyrings/fluentbit-keyring.asc
+fluent_bit_apt_source: "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.asc] https://packages.fluentbit.io/debian/{{ ansible_distribution_release }} {{ ansible_distribution_release }} main"
+fluent_bit_startup_command: /opt/fluent-bit/bin/fluent-bit -c /etc/fluent-bit/fluent-bit.yml
+
+fluent_bit_configuration: ""

roles/debian/fluent-bit/tasks/main.yml

@@ -0,0 +1,68 @@
+---
+- name: Add the Fluent Bit server GPG key to system keyring and source repository to apt sources.
+  block:
+    - name: Get the repository key.
+      ansible.builtin.get_url:
+        url: "{{ fluent_bit_repo_key_url }}"
+        dest: "{{ fluent_bit_key_location }}"
+
+    - name: Set apt source.
+      ansible.builtin.apt_repository:
+        repo: "{{ fluent_bit_apt_source }}"
+        state: present
+
+- name: Install Fluent-bit.
+  ansible.builtin.apt:
+    name: fluent-bit
+    state: present
+
+- name: Get list of configuration files that come with the pacakge installation.
+  ansible.builtin.find:
+    path: /etc/fluent-bit
+    patterns: .*conf
+  register: conf
+
+- name: Remove configuration files that come with the pacakge installation.
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items: "{{ conf.files }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+- name: Ensure that systemd override directory exists.
+  ansible.builtin.file:
+    path: "/etc/systemd/system/fluent-bit.service.d/"
+    state: directory
+    mode: '0755'
+
+- name: Ensure systemd service file override is in place.
+  ansible.builtin.template:
+    src: fluent-bit.service.j2
+    dest: "/etc/systemd/system/fluent-bit.service.d/override.conf"
+    mode: '0644'
+  register: config_service
+
+- name: Create or update main configuration file.
+  ansible.builtin.template:
+    src: fluent-bit.config.yml.j2
+    dest: "/etc/fluent-bit/fluent-bit.yml"
+    mode: '0644'
+  register: config
+
+- name: Reload systemd daemon.
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: config_service.changed
+
+- name: Restart Fluent-bit to apply config updates.
+  ansible.builtin.service:
+    name: "fluent-bit.service"
+    state: restarted
+  when: config.changed
+
+- name: Check that service is enabled and started.
+  ansible.builtin.systemd_service:
+    name: fluent-bit.service
+    enabled: true
+    state: started

roles/debian/fluent-bit/templates/fluent-bit.config.yml.j2

@@ -0,0 +1,3 @@
+{{ ansible_managed | comment }}
+
+{{ fluent_bit_configuration | to_nice_yaml(indent=2, sort_keys=false) }}

roles/debian/fluent-bit/templates/fluent-bit.service.j2

@@ -0,0 +1,4 @@
+{# ExecStart is used twice so that the variable gets cleared first before applying our variable #}
+[Service]
+ExecStart=
+ExecStart={{ fluent_bit_startup_command }}

roles/debian/nginx/defaults/main.yml

@@ -14,8 +14,8 @@ nginx:
     worker_connections: 768
   http:
     server_names_hash_bucket_size: 256
-    access_log: /var/log/nginx-access.log
-    error_log: /var/log/nginx-error.log
+    access_log: /var/log/nginx/nginx-access.log
+    error_log: /var/log/nginx/nginx-error.log
     ssl_protocols: "TLSv1.2 TLSv1.3"
     sendfile: "on"
     keepalive_timeout: 65