WIP changes for adding hosts to checkmk

ansible/playbooks/checkmk.yml

@@ -21,7 +21,7 @@
         - checkmk_host
         - checkmk_all
 
-    - name: Add Windows host into check
+    - name: Add Windows host into checkMK
       checkmk.general.host:
         server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
         site: "{{ checkmk_agent_site }}"
@@ -92,11 +92,25 @@
             - checkmk_all
             - checkmk_agent
 
-        - name: register for TLS 
-          win_shell: |
-            sl 'C:\Program Files (x86)\checkmk\service'
-            .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
+        - name: TLS registrtion
+          block: 
+            - name: register for TLS
+              win_shell: |
+                sl 'C:\Program Files (x86)\checkmk\service'
+                .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
+              #when: project_zone == 'standard' or
+              #      inventory_hostname in groups['meta-type_server']
+
+            #- name: register TLS on client (Protected)
+            #  vars:
+            #    ansible_connection: local
+            #  shell: |
+            #    sudo cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
+            #  delegate_to: localhost
+            #  when: project_zone == 'protected' and
+            #        inventory_hostname in groups['meta-type_client']
           tags: 
             - checkmk_host
             - checkmk_tls
-            - checkmk_all
+            - checkmk_all
+          

ansible/roles/win_proxy/handlers/main.yml

@@ -3,4 +3,15 @@
 - name: Restart squid
   ansible.builtin.service:
     name: "{{ squid_service }}"
-    state: restarted
+    state: restarted
+
+- name: "Activate Changes"
+  listen: activate changes
+  checkmk.general.activation:
+    server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+    site: "{{ checkmk_agent_site }}"
+    automation_user: "{{ checkmk_agent_user }}"
+    automation_secret: "{{ checkmk_password }}"
+    force_foreign_changes: "false"
+    validate_certs: "false"
+  run_once: true

ansible/roles/win_proxy/tasks/checkmk.yml

@@ -0,0 +1,35 @@
+---
+
+- name: Gather the package facts
+  ansible.builtin.package_facts:
+    manager: apt
+
+- name: Setup CheckMK agent
+  block:
+    - name: Include CheckMK variables
+      ansible.builtin.include_vars:
+        file: ../vars/checkmk.yml
+
+    - name: Add proxy host into checkMK
+      checkmk.general.host:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        validate_certs: "true"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        folder: "/"
+        name: "{{ inventory_hostname }}"
+        attributes:
+          ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}"
+        state: "present"
+      notify: "activate changes"
+
+    - name: Install CheckMK Agent
+      import_role:
+        name: checkmk.general.agent
+      when: ansible_facts.packages['check-mk-agent'] | default('Missing') == 'Missing'
+
+    - name: register agent for TLS
+      shell: |
+        cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
+      

ansible/roles/win_proxy/tasks/main.yml

@@ -69,4 +69,9 @@
     state: started
     enabled: true
   when:
-    - not ansible_check_mode
+    - not ansible_check_mode
+
+- name: Import checkmk.yml
+  import_tasks:
+    file: checkmk.yml
+  tags: proxy_cmk

ansible/vars/protected.yml

@@ -80,7 +80,11 @@ remote_ip_rules:
   - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"}
   - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"}
   - { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"}
+  - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"}
 # Proxy
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"}
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"}
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"}
+  - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK"}
+  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"}
+