X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/f1f617ac9c5d317239a1b770e25216ea3efda2e7..c582ab1c5ed6296029d9ea33fa2026f7631de40e:/cookbooks/kibana/recipes/default.rb diff --git a/cookbooks/kibana/recipes/default.rb b/cookbooks/kibana/recipes/default.rb index 44ffb2983..a3c8dc9f9 100644 --- a/cookbooks/kibana/recipes/default.rb +++ b/cookbooks/kibana/recipes/default.rb @@ -1,4 +1,3 @@ -# coding: utf-8 # # Cookbook Name:: kibana # Recipe:: default @@ -9,7 +8,7 @@ # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, @@ -20,7 +19,7 @@ require "yaml" -include_recipe "apache::ssl" +include_recipe "apache" apache_module "proxy_http" @@ -34,7 +33,7 @@ end directory "/opt/kibana-#{version}" do owner "root" group "root" - mode 0755 + mode 0o755 end execute "unzip-kibana-#{version}" do @@ -48,19 +47,19 @@ end directory "/etc/kibana" do owner "root" group "root" - mode 0755 + mode 0o755 end directory "/var/run/kibana" do owner "kibana" group "kibana" - mode 0755 + mode 0o755 end directory "/var/log/kibana" do owner "kibana" group "kibana" - mode 0755 + mode 0o755 end systemd_service "kibana@" do @@ -68,27 +67,38 @@ systemd_service "kibana@" do after "network.target" user "kibana" exec_start "/opt/kibana-#{version}/bin/kibana -c /etc/kibana/%i.yml" + private_tmp true + private_devices true + protect_system "full" + protect_home true + no_new_privileges true restart "on-failure" end node[:kibana][:sites].each do |name, details| file "/etc/kibana/#{name}.yml" do - content YAML.dump(YAML.load(File.read("/opt/kibana-#{version}/config/kibana.yml")).merge( + content YAML.dump(YAML.safe_load(File.read("/opt/kibana-#{version}/config/kibana.yml")).merge( "port" => details[:port], "host" => "127.0.0.1", "elasticsearch_url" => details[:elasticsearch_url], "pid_file" => "/var/run/kibana/#{name}.pid", "log_file" => "/var/log/kibana/#{name}.log" - )) + )) owner "root" group "root" - mode 0644 + mode 0o644 notifies :restart, "service[kibana@#{name}]" end service "kibana@#{name}" do action [:enable, :start] supports :status => true, :restart => true, :reload => false + subscribes :restart, "systemd_service[kibana@]" + end + + ssl_certificate details[:site] do + domains details[:site] + notifies :reload, "service[apache2]" end apache_site details[:site] do