102 lines
3.9 KiB
YAML
102 lines
3.9 KiB
YAML
---
|
||
- name: Check rsyslog configuration drift
|
||
hosts: rsyslog_servers
|
||
gather_facts: false
|
||
|
||
# NOTE: src paths below resolve relative to the Ansible controller (the
|
||
# Woodpecker CI container), so they always reflect the latest Git commit –
|
||
# NOT the server's local clone, which may be stale.
|
||
|
||
tasks:
|
||
# -------------------------------------------------------------------------
|
||
# Use Ansible copy in check_mode so it compares controller files (Git)
|
||
# against live server files without actually writing anything.
|
||
# changed=true → file differs → drift
|
||
# changed=false → files match → synced
|
||
# -------------------------------------------------------------------------
|
||
- name: Check main rsyslog.conf
|
||
ansible.builtin.copy:
|
||
src: "{{ playbook_dir }}/../../files/rsyslog.conf"
|
||
dest: "{{ rsyslog_main_config }}"
|
||
owner: root
|
||
group: root
|
||
mode: '0644'
|
||
check_mode: true
|
||
diff: true
|
||
register: main_config_check
|
||
|
||
- name: Check rsyslog.d config files
|
||
ansible.builtin.copy:
|
||
src: "{{ playbook_dir }}/../../files/rsyslog.d/"
|
||
dest: "{{ rsyslog_config_dir }}/"
|
||
owner: root
|
||
group: root
|
||
mode: '0644'
|
||
check_mode: true
|
||
diff: true
|
||
register: rsyslogd_check
|
||
|
||
- name: Check for extra files on server not present in Git
|
||
block:
|
||
- name: Find config files on server
|
||
ansible.builtin.find:
|
||
paths: "{{ rsyslog_config_dir }}"
|
||
patterns: "*.conf"
|
||
register: server_configs
|
||
|
||
- name: Find config files in Git (controller)
|
||
ansible.builtin.find:
|
||
paths: "{{ playbook_dir }}/../../files/rsyslog.d"
|
||
patterns: "*.conf"
|
||
delegate_to: localhost
|
||
register: repo_configs
|
||
|
||
- name: Build list of Git-managed filenames
|
||
ansible.builtin.set_fact:
|
||
git_filenames: "{{ repo_configs.files | map(attribute='path') | map('basename') | list }}"
|
||
|
||
- name: Build list of server filenames
|
||
ansible.builtin.set_fact:
|
||
server_filenames: "{{ server_configs.files | map(attribute='path') | map('basename') | list }}"
|
||
|
||
- name: Find server files that are managed by Git but missing on server
|
||
ansible.builtin.set_fact:
|
||
missing_on_server: "{{ git_filenames | difference(server_filenames) }}"
|
||
|
||
- name: Flag if any Git-managed file is missing from server
|
||
ansible.builtin.set_fact:
|
||
extra_files_on_server: true
|
||
when: missing_on_server | length > 0
|
||
|
||
- name: Show missing files
|
||
ansible.builtin.debug:
|
||
msg: "Files in Git but missing on server: {{ missing_on_server }}"
|
||
when: missing_on_server | length > 0
|
||
|
||
- name: Set overall drift flag
|
||
ansible.builtin.set_fact:
|
||
drift_detected: "{{ main_config_check.changed or rsyslogd_check.changed or (extra_files_on_server | default(false)) }}"
|
||
|
||
- name: Print SYNCED status
|
||
ansible.builtin.debug:
|
||
msg: |
|
||
╭─────────────────────────────╮
|
||
│ ✓ SYNCED │
|
||
│ Configuration is up-to-date │
|
||
╰─────────────────────────────╯
|
||
when: not drift_detected
|
||
|
||
- name: Print OUT OF SYNC status
|
||
ansible.builtin.debug:
|
||
msg: |
|
||
╭─────────────────────────────╮
|
||
│ ✗ OUT OF SYNC │
|
||
│ Configuration has drifted │
|
||
╰─────────────────────────────╯
|
||
when: drift_detected
|
||
|
||
- name: Fail if drift detected
|
||
ansible.builtin.fail:
|
||
msg: "Configuration drift detected. Live system does not match repository."
|
||
when: drift_detected
|