Linting for rsyslog

.yamllint.yaml

@@ -13,7 +13,7 @@ rules:
     allow-quoted-quotes: false
     check-keys: false
 
-# ansible-lint compatibility:
+  # ansible-lint compatibility:
   comments:
     min-spaces-from-content: 1
 
@@ -25,3 +25,8 @@ rules:
   octal-values:
     forbid-implicit-octal: true
     forbid-explicit-octal: true
+
+  commas:
+    ignore: |
+      # uses spaces for outlining
+      /roles/rsyslog/defaults/main.yml

roles/rsyslog/defaults/main.yml

@@ -1,17 +1,17 @@
 ---
-rsyslog_ca: /etc/pki/rsyslog/rsyslog_ca.pem
-rsyslog_dir: /opt/openconext/logs
-rsyslog_read_group: adm
-loglogins_max_age: 6
-stepupapps:
-  - gateway
-  - selfservice
-  - ra
-  - middleware
-  - webauthn
-  - tiqr
-  - azure-mfa
-  - azuremfa
+rsyslog_ca: "/etc/pki/rsyslog/rsyslog_ca.pem"
+rsyslog_dir: "/opt/openconext/logs"
+rsyslog_read_group: "adm"
+rsyslog_loglogins_max_age: 6
+rsyslog_stepupapps:
+  - "gateway"
+  - "selfservice"
+  - "ra"
+  - "middleware"
+  - "webauthn"
+  - "tiqr"
+  - "azure-mfa"
+  - "azuremfa"
 
 rsyslog_dir_file_modes: >
   dirCreateMode="0755"
@@ -35,12 +35,12 @@ rsyslog_queue_dir: "/var/spool/rsyslog"
 rsyslog_imjournal_ratelimitburst: 20000
 rsyslog_imjournal_ratelimitinterval: 60
 
-# rsyslog_imjournal_statefile # default is imjournal.state which means imjournal.state relative to the rsyslog workdir
-# rsyslog_workdirectory # default /var/spool/rsyslog
+rsyslog_imjournal_statefile: "imjournal.state"
+rsyslog_workdirectory: "/var/spool/rsyslog"
 
 # Empty log check script, optional
 rsyslog_enable_warn_empty_script: false
-rsyslog_warn_empty_log_recipient: admin@example.com
+rsyslog_warn_empty_log_recipient: "admin@example.com"
 rsyslog_monitor_for_emptylogs_path: "{{ rsyslog_dir }}/apps/prod_sc"
 rsyslog_checkemptylogs_cron_minute: "0"
 rsyslog_checkemptylogs_cron_hour: "9"
@@ -50,67 +50,75 @@ rsyslog_checkemptylogs_dir: "/usr/local/bin"
 # messages can become quote large; e.g., Engineblock sometimes dumps large SAMLResponses
 rsyslog_maxmessagesize: "32k"
 
+
+# matching rules for distributing logs on central loghost
+# order is important!  First matching rule wins.
+#
 # "program" matches the syslog identifier
 # "contains" and "startswith" match the syslog message
-# order is important!  First matching rule wins.
+# "dir" defaults to `apps`
+#
+# final path of the log file is `{{ rsyslog_dir }}/{{ dir }}/{{ env_name }}/{{ target }}`
 rsyslog_central_apps:
   # infra
-  -  { program: "haproxy",                target: "haproxy/haproxy.log" }
-  -  { program: "acme.sh",                target: "haproxy/acme.log" }
-  -  { program: "mariadb",                target: "galera/galera.log" }
-  -  { program: "mongod",                 target: "mongo/mongo.log" }
-  -  { program: "garb-systemd",           target: "galera/galera_garb.log" }
-  -  { program: "Keepalived_vrrp",        target: "keepalived/keepalived.log" }
-  -  { program: "loadbalancer",           target: "traefik/traefik.log" }
+  - { program: "haproxy",                target: "haproxy/haproxy.log" }
+  - { program: "acme.sh",                target: "haproxy/acme.log" }
+  - { program: "mariadb",                target: "galera/galera.log" }
+  - { program: "mongod",                 target: "mongo/mongo.log" }
+  - { program: "garb-systemd",           target: "galera/galera_garb.log" }
+  - { program: "Keepalived_vrrp",        target: "keepalived/keepalived.log" }
+  - { program: "loadbalancer",           target: "traefik/traefik.log" }
 
   # core
-  -  { program: "engineblock",            contains: '"channel":"authentication"',              dir: "log_logins", target: "eb-authentication.log" }
-  -  { program: "stepup-authentication",                                                       dir: "log_logins", target: "stepup-authentication.log" }
-
-  -  { program: "engineblock",            startswith: "engine",   target: "eb/apache.log" }
-  -  { program: "Apache-EB",              target: "eb/apache.log" }  # probably ununsed
-
-  -  { program: "engineblock",            target: "eb/eb.log" }
-  -  { program: "EBLOG",                  target: "eb/eb.log" }
-  -  { program: "Apache-EBAPI",           target: "eb-api/apache.log" }  # probably ununsed
-  -  { program: "oidcngserver",           target: "oidcng/oidcng.log" }
-  -  { program: "oicdngjson",             target: "oidcng/oidcngjson.log" }
-  -  { program: "oidcplaygroundserver",   target: "oidc-playground/oidc-playground.log" }
-  -  { program: "oidcplaygroundgui",      target: "oidc-playground/oidc-playground-apache.log" }
-  -  { program: "manageserver",           target: "manage/manage.log" }
-  -  { program: "managegui",              target: "manage/apache.log" }
+  - { program: "engineblock",            contains: '"channel":"authentication"',              dir: "log_logins", target: "eb-authentication.log" }
+  - { program: "stepup-authentication",                                                       dir: "log_logins", target: "stepup-authentication.log" }
+
+  - { program: "engineblock",            startswith: "engine",   target: "eb/apache.log" }
+  - { program: "Apache-EB",              target: "eb/apache.log" }  # probably ununsed
+
+  - { program: "engineblock",            target: "eb/eb.log" }
+  - { program: "EBLOG",                  target: "eb/eb.log" }
+  - { program: "Apache-EBAPI",           target: "eb-api/apache.log" }  # probably ununsed
+  - { program: "oidcngserver",           target: "oidcng/oidcng.log" }
+  - { program: "oicdngjson",             target: "oidcng/oidcngjson.log" }
+  - { program: "oidcplaygroundserver",   target: "oidc-playground/oidc-playground.log" }
+  - { program: "oidcplaygroundgui",      target: "oidc-playground/oidc-playground-apache.log" }
+  - { program: "manageserver",           target: "manage/manage.log" }
+  - { program: "managegui",              target: "manage/apache.log" }
 
   # core-supporting
-  -  { program: "aaserver",               target: "aa/aa.log" }
-  -  { program: "aagui",                  target: "aa/apache.log" }
-  -  { program: "aalink",                 target: "aa/apache.log" }
-  -  { program: "vootserver",             target: "voot/voot.log" }
-  -  { program: "pdp",                    target: "pdp/pdp.log" }
+  - { program: "aaserver",               target: "aa/aa.log" }
+  - { program: "aagui",                  target: "aa/apache.log" }
+  - { program: "aalink",                 target: "aa/apache.log" }
+  - { program: "vootserver",             target: "voot/voot.log" }
+  - { program: "pdp",                    target: "pdp/pdp.log" }
 
   # Invite
-  -  { program: "inviteclient",           target: "invite/inviteclient.log" }
-  -  { program: "invitewelcome",          target: "invite/invitewelcome.log" }
-  -  { program: "inviteserver",           target: "invite/inviteserver.log" }
-  -  { program: "invitejson",             target: "invite/invitejson.log" }
-  -  { program: "inviteprovisioningmock", target: "invite/inviteprovisioningmock.log" }
+  - { program: "inviteclient",           target: "invite/inviteclient.log" }
+  - { program: "invitewelcome",          target: "invite/invitewelcome.log" }
+  - { program: "inviteserver",           target: "invite/inviteserver.log" }
+  - { program: "invitejson",             target: "invite/invitejson.log" }
+  - { program: "inviteprovisioningmock", target: "invite/inviteprovisioningmock.log" }
 
   # dashboards
-  -  { program: "dashboardgui",           target: "dashboard/apache.log" }
-  -  { program: "dashboardserver",        target: "dashboard/dashboard.log" }
-  -  { program: "profile",                startswith: "{",               target: "profile/profile.log" }
-  -  { program: "profile",                target: "profile/apache.log" }
+  - { program: "dashboardgui",           target: "dashboard/apache.log" }
+  - { program: "dashboardserver",        target: "dashboard/dashboard.log" }
+  - { program: "spdashboard",            startswith: "spdashboard",    target: "spdashboard/spdashboard.log" }
+  - { program: "spdashboard",            target: "spdashboard/apache.log" }
+  - { program: "profile",                startswith: "{",               target: "profile/profile.log" }
+  - { program: "profile",                target: "profile/apache.log" }
 
   # static
-  -  { program: "Apache-STATIC",          target: "static/apache.log" }
-  -  { program: "Apache-METADATA",        target: "metadata/apache.log" }
+  - { program: "Apache-STATIC",          target: "static/apache.log" }
+  - { program: "Apache-METADATA",        target: "metadata/apache.log" }
 
   # MyConext
-  -  { program: "myconextserver",         target: "eduid/myconext.log" }
-  -  { program: "myconextjson",           target: "eduid/myconextjson.log" }
-  -  { program: "myconextgui",            target: "eduid/myconext-apache.log" }
-  -  { program: "accountgui",             target: "eduid/account-apache.log" }
-  -  { program: "servicedeskgui",         target: "eduid/servicedesk-apache.log" }
-  -  { program: "gateway",                contains: '"message":"Second Factor Authenticated"', dir: "log_logins", target: "stepup-authentication.log" }
-  -  { program: "gateway",                contains: '"message":"Intrinsic Loa Requested"',     dir: "log_logins", target: "stepup-authentication.log" }
-  -  { program: "spdashboard",            startswith: "spdashboard",    target: "spdashboard/spdashboard.log" }
-  -  { program: "spdashboard",            target: "spdashboard/apache.log" }
+  - { program: "myconextserver",         target: "eduid/myconext.log" }
+  - { program: "myconextjson",           target: "eduid/myconextjson.log" }
+  - { program: "myconextgui",            target: "eduid/myconext-apache.log" }
+  - { program: "accountgui",             target: "eduid/account-apache.log" }
+  - { program: "servicedeskgui",         target: "eduid/servicedesk-apache.log" }
+
+  # SSID log_logins
+  - { program: "gateway",                contains: '"message":"Second Factor Authenticated"', dir: "log_logins", target: "stepup-authentication.log" }
+  - { program: "gateway",                contains: '"message":"Intrinsic Loa Requested"',     dir: "log_logins", target: "stepup-authentication.log" }

roles/rsyslog/handlers/main.yml

@@ -1,13 +1,14 @@
 ---
-- name: restart rsyslog
-  service:
-    name: rsyslog
-    state: restarted
+- name: "Restart rsyslog"
+  ansible.builtin.systemd_service:
+    name: "rsyslog"
+    state: "restarted"
 
-- name: Restart journald
+- name: "Restart journald"
   ansible.builtin.systemd_service:
-    name: systemd-journald
-    state: restarted
+    name: "systemd-journald"
+    state: "restarted"
 
-- name: Reload systemd
-  ansible.builtin.command: "systemctl daemon-reload" # noqa command-instead-of-module
+- name: "Reload systemd"
+  ansible.builtin.systemd_service:
+    daemon_reload: true

roles/rsyslog/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: remove old files
+- name: "Remove old files"
   ansible.builtin.file:
     path: "/etc/pki/rsyslog/{{  item }}"
     state: "absent"
@@ -9,132 +9,116 @@
     - "rsyslogclientcaprd.crt"
     - "rsyslogclientprd.crt"
 
-- name: Install rsyslog and python modules
+- name: "Install rsyslog and python modules"
   ansible.builtin.package:
     name:
-      - rsyslog
-      - rsyslog-gnutls
-      - rsyslog-relp
-    state: present
+      - "rsyslog"
+      - "rsyslog-gnutls"
+      - "rsyslog-relp"
+    state: "present"
   notify:
-    - "restart rsyslog"
+    - "Restart rsyslog"
 
-- name: Install rsyslog and python modules
-  ansible.builtin.package:
-    name:
-      - python3-dateutil
-    state: present
-  when: "'centrallog_servers' in group_names and ansible_distribution_major_version > '7'"
-  notify:
-    - "restart rsyslog"
-
-- name: Create the group that is allowed to read the logs
+- name: "Create the group that is allowed to read the logs"
   ansible.builtin.group:
     name: "{{ rsyslog_read_group }}"
-    state: present
+    state: "present"
 
 # note: this config file supports both local-log-only and central syslog hosts
-- name: Put rsyslog config file
+- name: "Put rsyslog config file"
   ansible.builtin.template:
     src: "rsyslog.conf.j2"
     dest: "/etc/rsyslog.conf"
-    owner: root
-    group: root
     mode: "0644"
   notify:
-    - "restart rsyslog"
+    - "Restart rsyslog"
 
 # journald forwards logs to rsyslog
-- name: When using imjournal no forwarding necessary
+- name: "When using imjournal no forwarding necessary"
   ansible.builtin.lineinfile:
-    path: /etc/systemd/journald.conf
-    search_string: 'ForwardToSyslog='
-    line: 'ForwardToSyslog=no'
+    path: "/etc/systemd/journald.conf"
+    search_string: "ForwardToSyslog="
+    line: "ForwardToSyslog=no"
   notify:
     - "Restart journald"
 
-- name: Remove logging dropin
+- name: "Remove logging dropin"
   ansible.builtin.file:
     path: "{{ rsyslog_service_dropindir }}/logging.conf"
-    state: absent
+    state: "absent"
   notify:
     - "Reload systemd"
-    - "restart rsyslog"
+    - "Restart rsyslog"
 
 # Since we specify queue.spoolDirectory, lets make sure it exists
-- name: Create queue dir
+- name: "Create queue dir"
   ansible.builtin.file:
     path: "{{ rsyslog_queue_dir }}"
-    state: directory
-    owner: root
-    group: root
+    state: "directory"
     mode: "0700"
 
 # rsyslog certificates for relp
-- name: Create the pki directory if it does not exist
+- name: "Create the pki directory if it does not exist"
   ansible.builtin.file:
     path: "{{ rsyslog_certifcate_dir }}"
-    state: directory
-    owner: root
-    group: root
+    state: "directory"
     mode: "0755"
 
 # We need a key and client certificate to when using RELP
-- name: Put rsyslog client key
+- name: "Put rsyslog client key"
   ansible.builtin.copy:
     content: "{{ rsyslogclientkey }}"
     dest: "{{ rsyslog_certifcate_dir }}/rsyslogclient.key"
     mode: "0400"
-    owner: root
   no_log: true
   notify:
-    - "restart rsyslog"
+    - "Restart rsyslog"
 
-- name: Put rsyslog client certificate
+- name: "Put rsyslog client certificate"
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/files/certs/rsyslog/rsyslogclient.crt"
     dest: "{{ rsyslog_certifcate_dir }}/rsyslogclient.crt"
     mode: "0644"
-    owner: root
-    group: adm
+    owner: "root"
+    group: "adm"
   notify:
-    - "restart rsyslog"
+    - "Restart rsyslog"
 
-- name: Put rsyslog CA file
+- name: "Put rsyslog CA file"
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/files/certs/rsyslog/rsyslog_ca.crt"
     dest: "{{ rsyslog_ca }}"
     mode: "0644"
-    owner: root
-    group: root
   notify:
-    - "restart rsyslog"
+    - "Restart rsyslog"
 
 # Not sure why this is necessary on the forwarding server
 # but seems to work
-- name: Allow extra port rsyslog_tls_port_t
+- name: "Allow extra port rsyslog_tls_port_t"
   community.general.seport:
     ports: "{{ rsyslog_remote_relp_port }}"
-    proto: tcp
-    setype: syslog_tls_port_t
-    state: present
-  when: ansible_selinux.mode is defined and ansible_selinux.mode  == "enforcing"
+    proto: "tcp"
+    setype: "syslog_tls_port_t"
+    state: "present"
+  when: "ansible_selinux.mode is defined  and  ansible_selinux.mode == 'enforcing'"
 
 #### central logserver
 
-- name: Include tasks for configuring the central log server
+- name: "Include tasks for configuring the central log server"
   when: "'centrallog_servers' in group_names"
   block:
-    - name: Include tasks for central syslog server
-      ansible.builtin.include_tasks: rsyslog_central.yml
+    - name: "Include tasks for central syslog server"
+      ansible.builtin.include_tasks:
+        file: "rsyslog_central.yml"
 
-    - name: Include tasks for authentication log processing
-      ansible.builtin.include_tasks: process_auth_logs.yml
+    - name: "Include tasks for authentication log processing"
+      ansible.builtin.include_tasks:
+        file: "process_auth_logs.yml"
       when: "'auth_processor' in group_names"
 
 ### and enable
 
-- name: Enable rsyslog
+- name: "Enable rsyslog"
   ansible.builtin.service:
-    name: rsyslog
+    name: "rsyslog"
     enabled: true