Merge branch 'checkmk'

ansible/playbooks/checkmk.yml

@@ -1,4 +1,91 @@
 ---
+- name: CheckMK Hosts
+  hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
+  gather_facts: false
+  vars_files:
+    - ../vars/checkmk.yml
+    - ../vars/common.yml
+  tasks:
+    - name: "Create folder for eidf project"
+      checkmk.general.folder:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        path: "/{{ os_project }}-{{ win_project }}"
+        name: "{{ os_project }}-{{ win_project }}"
+        state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after
+      run_once: true
+      delegate_to: "localhost"
+      tags: 
+        - checkmk_folder
+        - checkmk_host
+        - checkmk_all
+
+    - name: Add Windows host into checkMK
+      checkmk.general.host:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        validate_certs: "true"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        folder: "/{{ os_project }}-{{ win_project }}"
+        name: "{{ inventory_hostname }}"
+        attributes:
+          ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}"
+          tag_Variant: "{{ hostvars[inventory_hostname].openstack.metadata.variant }}"
+          tag_project_zone: "{{ project_zone }}"
+        state: "{{ state }}"
+      delegate_to: "localhost"
+      notify: "activate changes"
+      tags: 
+        - checkmk_host
+        - checkmk_all
+
+    - name: "Create folder for eidf project"
+      checkmk.general.folder:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        path: "/{{ os_project }}-{{ win_project }}"
+        name: "{{ os_project }}-{{ win_project }}"
+        state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after
+      run_once: true
+      notify: "activate changes"
+      delegate_to: "localhost"
+      tags: 
+        - teardown
+
+    - name: Move Proxy to project specific checkmk folder
+      checkmk.general.host:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        validate_certs: "true"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        folder: "/{{ os_project }}-{{ win_project }}"
+        name: "{{ os_project }}-{{ win_project }}-proxy"
+        state: "present"
+      run_once: true
+      delegate_to: "localhost"
+      notify: "activate changes"
+      when: project_zone == 'protected'
+      tags: checkmk_proxy
+
+  handlers:
+    - name: "Activate Changes"
+      listen: activate changes
+      checkmk.general.activation:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        force_foreign_changes: "false"
+        validate_certs: "true"
+      delegate_to: "localhost"
+      run_once: true
+
 - name: CheckMK Agent
   hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
   gather_facts: false
@@ -24,41 +111,25 @@
             - checkmk_all
             - checkmk_agent
 
-- name: CheckMK Hosts
+        - name: TLS registrtion
-  hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
+          block: 
-  gather_facts: false
+            - name: register for TLS
-  vars_files:
+              win_shell: |
-    - ../vars/checkmk.yml
+                sl 'C:\Program Files (x86)\checkmk\service'
-    - ../vars/common.yml
+                .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
-  tasks:
+              #when: project_zone == 'standard' or
-    - name: Add Windows host into check
+              #      inventory_hostname in groups['meta-type_server']
-      checkmk.general.host:
-        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
-        site: "{{ checkmk_agent_site }}"
-        validate_certs: "true"
-        automation_user: "{{ checkmk_agent_user }}"
-        automation_secret: "{{ checkmk_password }}"
-        folder: "/"
-        name: "{{ inventory_hostname }}"
-        attributes:
-          ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}"
-        state: "{{ state }}"
-      delegate_to: "localhost"
-      notify: "activate changes"
-      tags: 
-        - checkmk_host
-        - checkmk_all
-        - teardown
 
-  handlers:
+            #- name: register TLS on client (Protected)
-    - name: "Activate Changes"
+            #  vars:
-      listen: activate changes
+            #    ansible_connection: local
-      checkmk.general.activation:
+            #  shell: |
-        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+            #    sudo cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
-        site: "{{ checkmk_agent_site }}"
+            #  delegate_to: localhost
-        automation_user: "{{ checkmk_agent_user }}"
+            #  when: project_zone == 'protected' and
-        automation_secret: "{{ checkmk_password }}"
+            #        inventory_hostname in groups['meta-type_client']
-        force_foreign_changes: "false"
+          tags: 
-        validate_certs: "true"
+            - checkmk_host
-      delegate_to: "localhost"
+            - checkmk_tls
-      run_once: true
+            - checkmk_all
+          

ansible/playbooks/openstack-vms.yml

@@ -1,9 +1,16 @@
 ---
 - hosts: localhost
+  vars:
+    vm_status: "{{ lookup('file', '/deployments/{{ os_project }}-{{ win_project }}/VM_STATUS') }}"
   vars_files:
     - ../vars/common.yml
     - ../vars/{{ project_zone }}.yml
   tasks:
+    - name: End early if VM already created
+      block:
+        - meta: end_play
+      when: vm_status == 'created'
+
     - name: Create workbench VMs (ASYNCHRONUS)
       tags: teardown
       os_server:
@@ -298,4 +305,14 @@
           type: server
           variant: web_proxy
           os: linux
-      when: project_zone == 'protected'
+      when: project_zone == 'protected'
+
+    - name: Set VM Status
+      vars:
+        ansible_connection: local
+      replace:
+        path: /deployments/{{ os_project }}-{{ win_project }}/VM_STATUS
+        regexp: '^pending$'
+        replace: 'created'
+      delegate_to: localhost
+      run_once: True

ansible/playbooks/win_proxy.yml

@@ -9,6 +9,6 @@
     - ../vars/common.yml
   roles:
     - role: win_proxy
-      become: yes
+      become: true
       tags: win_proxy
       when: project_zone == 'protected'

ansible/roles/win_client/tasks/main.yml

@@ -1,5 +1,5 @@
 ---
 - import_tasks: features.yml
 - import_tasks: chocolatey.yml
-- import_tasks: rd_gateway.yml
+- import_tasks: rdgw.yml
 - import_tasks: start_menu.yml

ansible/roles/win_initial/tasks/initial.yml

@@ -32,6 +32,7 @@
 
 - name: Reboot VMs before continuing
   win_reboot:
+  # Need a condition here for reruns
 
 - name: Remove Local Admin
   tags: 

ansible/roles/win_proxy/handlers/main.yml

@@ -3,4 +3,15 @@
 - name: Restart squid
   ansible.builtin.service:
     name: "{{ squid_service }}"
-    state: restarted
+    state: restarted
+
+- name: "Activate Changes"
+  listen: activate changes
+  checkmk.general.activation:
+    server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+    site: "{{ checkmk_agent_site }}"
+    automation_user: "{{ checkmk_agent_user }}"
+    automation_secret: "{{ checkmk_password }}"
+    force_foreign_changes: "false"
+    validate_certs: "false"
+  run_once: true

ansible/roles/win_proxy/tasks/checkmk.yml

@@ -0,0 +1,37 @@
+---
+
+- name: Gather the package facts
+  ansible.builtin.package_facts:
+    manager: apt
+
+- name: Setup CheckMK agent
+  block:
+    - name: Include CheckMK variables
+      ansible.builtin.include_vars:
+        file: ../vars/checkmk.yml
+
+    - name: Add proxy host into checkMK
+      checkmk.general.host:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        validate_certs: "true"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        folder: "/"
+        name: "{{ inventory_hostname }}"
+        attributes:
+          ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}"
+          tag_Variant: "proxy"
+          tag_project_zone: "{{ project_zone }}"
+        state: "present"
+      notify: "activate changes"
+
+    - name: Install CheckMK Agent
+      import_role:
+        name: checkmk.general.agent
+      when: ansible_facts.packages['check-mk-agent'] | default('Missing') == 'Missing'
+
+    - name: register agent for TLS
+      shell: |
+        cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
+      

ansible/roles/win_proxy/tasks/main.yml

@@ -69,4 +69,9 @@
     state: started
     enabled: true
   when:
-    - not ansible_check_mode
+    - not ansible_check_mode
+
+- name: Import checkmk.yml
+  import_tasks:
+    file: checkmk.yml
+  tags: proxy_cmk

ansible/roles/win_wsus/files/setup_wsus.ps1

@@ -1 +0,0 @@
-setup_wsus_v1.0.ps1

ansible/roles/win_wsus/files/wsus_setup.ps1

@@ -0,0 +1 @@
+wsus_setup_v1.0.ps1

ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1

@@ -0,0 +1,216 @@
+###############
+## Variables ##
+###############
+ 
+##//INSTALLATION//##
+
+# Do you want to install .NET FRAMEWORK 3.5? If true, provide a location for the Windows OS media in the next variable
+    $DotNet = $True
+# Do you want to download and install MS Report Viewer 2008 SP1 (required for WSUS Reports)?
+    $RepViewer = $True
+# WSUS Installation Type.  Enter "WID" (for WIndows Internal Database), "SQLExpress" (to download and install a local SQLExpress), or "SQLRemote" (for an existing SQL Instance).
+    $WSUSType = "WID"
+# Location to store WSUS Updates (will be created if doesn't exist)
+    $WSUSDir = "W:\WSUS"
+# Temporary location for installation files (will be created if doesn't exist)
+    $TempDir = "W:\temp"
+ 
+##//CONFIGURATION//##
+ 
+# Do you want to configure WSUS (equivalent of WSUS Configuration Wizard, plus some additional options)?  If $false, no further variables apply.
+# You can customise the configurations, such as Products and Classifications etc, in the "Begin Initial Configuration of WSUS" section of the script.
+    $ConfigureWSUS = $True
+# Do you want to decline some unwanted updates?
+    $DeclineUpdates = $True
+# Do you want to configure and enable the Default Approval Rule?
+    $DefaultApproval = $True
+# Do you want to run the Default Approval Rule after configuring?
+    $RunDefaultRule = $False
+
+
+# Install .Net Framework 3.5
+if($DotNet -eq $true)
+{
+write-host 'Installing .Net Framework 3.5'
+Install-WindowsFeature -name NET-Framework-Core
+}
+
+if (Test-Path -Path $WSUSDir) {
+    Write-Host 'Content Directory Exists'
+} else {
+    sl "C:\Program Files\Update Services\Tools"
+    .\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir
+}
+
+# Get WSUS Server Object
+$wsus = Get-WSUSServer
+ 
+# Connect to WSUS server configuration
+$wsusConfig = $wsus.GetConfiguration()
+ 
+# Set to download updates from Microsoft Updates
+Set-WsusServerSynchronization -SyncFromMU
+ 
+# Set Update Languages to English and save configuration settings
+$wsusConfig.AllUpdateLanguagesEnabled = $false
+$wsusConfig.SetEnabledUpdateLanguages("en")
+$wsusConfig.Save()
+
+
+
+
+# Get WSUS Subscription and perform initial synchronization to get latest categories
+$subscription = $wsus.GetSubscription()
+$subscription.StartSynchronizationForCategoryOnly()
+write-host 'Beginning first WSUS Sync to get available Products etc' -ForegroundColor Magenta
+write-host 'Will take some time to complete'
+While ($subscription.GetSynchronizationStatus() -ne 'NotProcessing') {
+    Write-Host "." -NoNewline
+    Start-Sleep -Seconds 5
+}
+write-host ' '
+Write-Host "Sync is done." -ForegroundColor Green
+
+
+
+
+# Configure the Platforms that we want WSUS to receive updates
+write-host 'Setting WSUS Products'
+Get-WsusProduct | where-Object {
+    $_.Product.Title -in (
+    '.NET 5.0',
+    '.NET 6.0',
+    '.NET 7.0',
+    '.NET 8.0',
+    '.NET Core 2.1',
+    '.NET Core 3.1',
+    'Active Directory',
+    'Microsoft 365 Apps/Office 2019/Office LTSC',
+    'Microsoft Defender Antivirus',
+    'Microsoft Security Essentials',
+    'Microsoft Server operating system-21H2',
+    'Microsoft Server Operating System-22H2',
+    'Microsoft Server Operating System-23H2',
+    'Microsoft Server Operating System-24H2',
+    'Microsoft SQL Server 2012',
+    'Microsoft SQL Server 2014',
+    'Microsoft SQL Server 2016',
+    'Microsoft SQL Server 2017',
+    'Microsoft SQL Server 2019',
+    'Microsoft SQL Server 2022',
+    'Microsoft SQL Server Management Studio v17',
+    'Microsoft SQL Server Management Studio v18',
+    'Microsoft SQL Server Management Studio v19',
+    'Microsoft SQL Server Management Studio v20',
+    'MS Security Essentials',
+    'PowerShell - x64',
+    'PowerShell',
+    'Security Essentials',
+    'Server 2022 Hotpatch Category',
+    'Silverlight',
+    'Silverlight',
+    'Visual Studio 2012',
+    'Visual Studio 2013',
+    'Visual Studio 2015 Update 3',
+    'Visual Studio 2015',
+    'Visual Studio 2017',
+    'Visual Studio 2019',
+    'Visual Studio 2022',
+    'Windows Admin Center',
+    'Windows - Server, version 21H2 and later, Servicing Drivers',
+    'Windows - Server, version 21H2 and later, Upgrade & Servicing Drivers',
+    'Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers',
+    'Windows Dictionary Updates',
+    'Windows Security platform',
+    'Windows Server 2019 and later, Servicing Drivers',
+    'Windows Server 2019 and later, Upgrade & Servicing Drivers',
+    'Windows Server 2019',
+    'Windows Server 2019',
+    'Windows Server Drivers',
+    'Windows Server Manager   Windows Server Update Services (WSUS) Dynamic Installer',
+    'Windows Server Technical Preview Language Packs',
+    'Windows Server, version 1903 and later')
+} | Set-WsusProduct
+
+Get-WsusProduct | where-Object { $_.Product.Title -eq 'Windows' } | Set-WsusProduct -Disable
+Get-WsusProduct | where-Object { $_.Product.Title -eq 'Developer Tools, Runtimes, and Redistributables' } | Set-WsusProduct -Disable
+
+# Configure the Classifications
+write-host 'Setting WSUS Classifications'
+Get-WsusClassification | Where-Object {
+    $_.Classification.Title -in (
+    'Critical Updates',
+    'Definition Updates',
+    'Security Updates')
+} | Set-WsusClassification
+
+
+
+
+
+# Prompt to check products are set correctly
+write-host 'Before continuing, please open the WSUS Console, cancel the WSUS Configuration Wizard,' - -ForegroundColor Red
+write-host 'Go to Options > Products and Classifications, and check that the Products are set correctly.' - -ForegroundColor Red
+write-host 'Pausing script' -ForegroundColor Yellow
+$Shell = New-Object -ComObject "WScript.Shell"
+$Button = $Shell.Popup("Click OK to continue.", 0, "Script Paused", 0) # Using Pop-up in case script is running in ISE
+
+
+
+
+# Configure Synchronizations
+write-host 'Enabling WSUS Automatic Synchronisation'
+$subscription.SynchronizeAutomatically=$true
+ 
+# Set synchronization scheduled for midnight each night
+$subscription.SynchronizeAutomaticallyTimeOfDay= (New-TimeSpan -Hours 0)
+$subscription.NumberOfSynchronizationsPerDay=1
+$subscription.Save()
+ 
+# Kick off a synchronization
+$subscription.StartSynchronization()
+
+
+
+# Monitor Progress of Synchronisation
+ 
+write-host 'Starting WSUS Sync, will take some time' -ForegroundColor Magenta
+Start-Sleep -Seconds 60 # Wait for sync to start before monitoring
+while ($subscription.GetSynchronizationProgress().ProcessedItems -ne $subscription.GetSynchronizationProgress().TotalItems) {
+    Write-Progress -PercentComplete (
+    $subscription.GetSynchronizationProgress().ProcessedItems*100/($subscription.GetSynchronizationProgress().TotalItems)
+    ) -Activity "WSUS Sync Progress"
+}
+Write-Host "Sync is done." -ForegroundColor Green
+
+
+### DECLINE STUFF
+
+
+#NEED TO try set-wsusproduct -disable
+
+# Configure Default Approval Rule
+ 
+if ($DefaultApproval -eq $True)
+{
+write-host 'Configuring default automatic approval rule'
+[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
+$rule = $wsus.GetInstallApprovalRules() | Where {
+    $_.Name -eq "Default Automatic Approval Rule"}
+$class = $wsus.GetUpdateClassifications() | ? {$_.Title -In (
+    'Critical Updates',
+    'Definition Updates',
+    'Feature Packs',
+    'Security Updates',
+    'Service Packs',
+    'Update Rollups',
+    'Updates')}
+$class_coll = New-Object Microsoft.UpdateServices.Administration.UpdateClassificationCollection
+$class_coll.AddRange($class)
+$rule.SetUpdateClassifications($class_coll)
+$rule.Enabled = $True
+$rule.Save()
+}
+
+$Apply = $rule.ApplyRule()
+

ansible/roles/win_wsus/tasks/configure.yml

@@ -2,16 +2,18 @@
 - name: Configure WSUS server
   tags: configure_wsus
   block:
-    - name: Ensure Content directory exists
+    #- name: Check if Content directory already exists 
-      win_file:
+    #  win_stat:
-        path: "{{ wsus_content_directory }}"
+    #    path: "{{ wsus_content_directory }}"
-        state: directory
+    #  register: folder
+    #  failed_when: folder.stat.exists
 
-    - name: Set WSUS Content Directory
+    #- name: Set WSUS Content Directory
-      tags: set_wsus_content_dir
+    #  tags: set_wsus_content_dir
-      win_shell: |
+    #  win_shell: |
-        CD "C:\Program Files\Update Services\Tools"
+    #    CD "C:\Program Files\Update Services\Tools"
-        .\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS
+    #    .\wsusutil.exe postinstall CONTENT_DIR={{ wsus_content_directory }}
+    #  when: not folder.stat.exists
 
     - name: WSUS Script
       tags: wsus_script
@@ -19,101 +21,11 @@
         - name: Copy WSUS script
           win_copy:
             src: "{{ wsus_script }}" 
-            dest: "powershell {{ script_dir }}\\{{ wsus_script }}"
+            dest: "{{ script_dir }}\\{{ wsus_script }}"
             force: true
           tags: copy_wsus_script
     
-        - name: Apply WSUS script
+        #- name: Apply WSUS script
-          win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}"
+           #win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}"
-          tags: apply_wsus_script
+           #tags: apply_wsus_script
 
-
-
-#- name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :(
-#  tags: testing
-#  win_dsc:
-#    resource_name: UpdateServicesServer
-#    Ensure: Present
-#    ContentDir: '{{ wsus_content_directory }}'
-#    Languages: en
-#    #Products: "{{ wsus_products }}"
-#    Products: "Windows Admin Center"
-#    PsDscRunAsCredential_username: Administrator
-#    PsDscRunAsCredential_password: "{{ ansible_password }}"
-#    #ErrorRecord: test
-#    Classifications:
-#      - "{{ CriticalUpdates }}"
-#      #- "{{ DefinitionUpdates }}"
-#      #- "{{ SecurityUpdates }}"
-#      #- "{{ ServicePacks }}"
-#      #- "{{ UpdateRollups }}"
-#      #- "{{ Updates }}"
-#    #Synchronize: True
-#    SynchronizeAutomatically: True
-#    SynchronizeAutomaticallyTimeOfDay: '15:30:00'
-#    ClientTargetingMode: "{{ wsus_client_targeting_mode }}"
-
-
-
-
-
-
-##- name: Configure WSUS server
-##  block:
-##  - name: Ensure Content directory exists
-##    win_file:
-##      path: '{{ wsus_content_dir }}'
-##      state: directory
-##  - name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :(
-##    win_dsc:
-##      resource_name: UpdateServicesServer
-##      Ensure: Present
-##      ContentDir: '{{ wsus_content_dir }}'
-##      Languages: en
-##      Products: "{{ wsus_products }}"
-##      Classifications:
-##        - "{{ wsus_category_names['CriticalUpdates'].id }}"
-##        #- "{{ wsus_category_names['DefinitionUpdates'].id }}"
-##        #- "{{ wsus_category_names['SecurityUpdates'].id }}"
-##        #- "{{ wsus_category_names['ServicePacks'].id }}"
-##        #- "{{ wsus_category_names['UpdateRollups'].id }}"
-##        #- "{{ wsus_category_names['Updates'].id }}"
-##      # Ignore upstream as we don't have one yet...
-##      #UpstreamServerName: "{{ wsus_upstream_server_name | default(omit) }}"
-##      #UpstreamServerPort: "{{ wsus_upstream_server_port | default(omit) }}"
-##      #UpstreamServerSSL: "{{ wsus_upstream_server_ssl | default(omit) }}"
-##      Synchronize: True
-##      SynchronizeAutomatically: True
-##      SynchronizeAutomaticallyTimeOfDay: '01:30:00'
-##      ClientTargetingMode: "{{ wsus_client_targeting_mode }}"
-##    ignore_errors: true
-##    retries: 2
-##  - name: Apply approval rules (UpdateServicesDSC)
-##    win_dsc:
-##      resource_name: UpdateServicesApprovalRule
-##      Name: "{{ wsus_category_names[item].name }}"
-##      Classifications: "{{ wsus_category_names[item].id }}"
-##      Enabled: True
-##      RunRuleNow: True
-##    loop:
-##      - CriticalUpdates
-##      #- DefinitionUpdates
-##      #- SecurityUpdates
-##      #- ServicePacks
-##      #- UpdateRollups
-##      #- Updates
-##  - name: Clean up updates (UpdateServicesDSC)
-##    win_dsc:
-##      resource_name: UpdateServicesCleanup
-##      Ensure: Present
-##      DeclineExpiredUpdates: True
-##      DeclineSupersededUpdates: True
-##      CleanupObsoleteUpdates: True
-##      CleanupUnneededContentFiles: True
-##  # Might be handy: https://github.com/slopez888/vsphere-ansible/blob/master/roles/wsus-server-configure/tasks/max_xml_per_request.yml
-##  - name: obtain WSUS DB name
-##    win_reg_stat:
-##      path: HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup
-##      name: SqlDatabaseName
-##    register: wsus_db_name
-##  when: inventory_hostname in groups['meta-Tags_wsus']

ansible/vars/protected.yml

@@ -75,12 +75,17 @@ remote_ip_rules:
   - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"}
   - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}
   - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"}
-  - { direction: "engress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"}
+  - { direction: "egress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"}
   - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"}
   - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"}
   - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"}
   - { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"}
+  - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"}
 # Proxy
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"}
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"}
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"}
+  - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK"}
+  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"}
+  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"}
+

register_vms.sh

@@ -5,7 +5,8 @@ declare -gr OS_PROJECT=$1
 declare -gr WIN_PROJECT=$2
 declare -gr API_TOKEN=$3
 declare -g RD_JOB_ID=$4
-declare -g RD_EXEC_ID=$5
+#declare -g RD_EXEC_ID=$5
+declare -g RD_EXEC_ID=$(cat /deployments/$OS_PROJECT-$WIN_PROJECT/EXEC_ID)
 
 export OS_CLIENT_CONFIG_FILE=/deployments/$OS_PROJECT-$WIN_PROJECT/clouds.yaml
 
@@ -26,10 +27,12 @@ initialize_json() {
         "job_id": "'$RD_JOB_ID'",
         "execution_id": "'$RD_EXEC_ID'",
         "status": "ok",
-        "DC": {},
+        "data": {
-        "WB": {"load_balancer": true, VM: []},
+            "DC": {},
-        "APP": {"load_balancer": false, VM: []},
+            "WB": {"load_balancer": true, VM: []},
-        "GPU": {"load_balancer": false, VM: []}
+            "APP": {"load_balancer": false, VM: []},
+            "GPU": {"load_balancer": false, VM: []}
+        }
     }' > $OUTPUT_FILE
     declare -g -r VM_JSON="/deployments/$OS_PROJECT-$WIN_PROJECT/data.json"
 }
@@ -42,16 +45,16 @@ add_vm() {
     declare -r TYPE=$4
 
     if [[ $TYPE == "DC" ]]; then
-        jq ".${TYPE} += {\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}" $VM_JSON > temp.json
+        jq ".data.${TYPE} += {\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}" $VM_JSON > temp.json
         mv -f temp.json $VM_JSON
     else
-        jq ".${TYPE}.VM += [{\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}]" $VM_JSON > temp.json
+        jq ".data.${TYPE}.VM += [{\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}]" $VM_JSON > temp.json
         mv -f temp.json $VM_JSON
     fi
 }
 
 post_request() {
-    declare -r API_ENDPOINT='https://projects.eidf.ac.uk/testportal/job/api/notification'
+    declare -r API_ENDPOINT='https://portal.eidf.ac.uk/job/api/notification'
     jq -c . $VM_JSON
     curl \
     -X POST \