From b4954bff7060feca1ef115213e6674d87da1b19a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eric=20B=C3=BCrki?= Date: Fri, 3 Jul 2026 13:40:03 +0200 Subject: [PATCH 1/2] feat(roles/icinga2_agent,roles/icinga2_master): deploy a systemd drop-in override ensuring the icinga 2 service starts after sssd on hosts where sssd is installed --- CHANGELOG.md | 1 + roles/icinga2_agent/README.md | 5 ++++ roles/icinga2_agent/tasks/main.yml | 25 +++++++++++++++++++ .../icinga2.service.d/z00-after-sssd.conf.j2 | 5 ++++ roles/icinga2_master/README.md | 5 ++++ roles/icinga2_master/tasks/main.yml | 24 ++++++++++++++++++ .../icinga2.service.d/z00-after-sssd.conf.j2 | 5 ++++ 7 files changed, 70 insertions(+) create mode 100644 roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 create mode 100644 roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 diff --git a/CHANGELOG.md b/CHANGELOG.md index ed6319be..f0f95086 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added +* **role:icinga2_agent, role:icinga2_master**: Deploy a systemd drop-in override ensuring the Icinga 2 service starts after SSSD on hosts where SSSD is installed. * **role:librenms**: Add `librenms__config_app_trusted_proxies` and `librenms__config_app_url` to set the `APP_TRUSTED_PROXIES` and `APP_URL` variables in `/opt/librenms/.env`, needed when running LibreNMS behind a reverse proxy. * **role:mariadb_server**: Add `mariadb_server__cnf_innodb_flush_neighbors__group_var` / `__host_var` to configure the `innodb_flush_neighbors` InnoDB system variable. Defaults to `0` (disabled), which is the recommended value for SSD/NVMe storage. * **role:freeipa_server**: Add `freeipa_server__limit_groups`, `freeipa_server__limit_hbacrules`, `freeipa_server__limit_hostgroups`, `freeipa_server__limit_pwpolicies`, `freeipa_server__limit_sudocmdgroups`, `freeipa_server__limit_sudocmds`, `freeipa_server__limit_sudorules` and `freeipa_server__limit_users` to manage only specific resources via `--extra-vars` instead of all of them, e.g. `--tags freeipa_server:users --extra-vars='freeipa_server__limit_users=["jdoe"]'`. Speeds up deployments on servers with many FreeIPA resources. diff --git a/roles/icinga2_agent/README.md b/roles/icinga2_agent/README.md index fb35703a..9c735481 100644 --- a/roles/icinga2_agent/README.md +++ b/roles/icinga2_agent/README.md @@ -44,6 +44,11 @@ Manual steps: * Manages the state of the Icinga2 service. * Triggers: none. +`icinga2_agent:systemd_override` + +* Deploys: `/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf`. +* Triggers: none. + `icinga2_agent:update` * Updates the Icinga2 package and restarts the service. diff --git a/roles/icinga2_agent/tasks/main.yml b/roles/icinga2_agent/tasks/main.yml index ce1f026f..21b90209 100644 --- a/roles/icinga2_agent/tasks/main.yml +++ b/roles/icinga2_agent/tasks/main.yml @@ -10,6 +10,31 @@ - 'icinga2_agent' +- block: + + - name: 'mkdir -p /etc/systemd/system/icinga2.service.d' + ansible.builtin.file: + path: '/etc/systemd/system/icinga2.service.d' + state: 'directory' + owner: 'root' + group: 'root' + mode: 0o755 + + - name: 'Deploy /etc/systemd/system/icinga2.service.d/z00-after-sssd.conf' + ansible.builtin.template: + backup: true + src: 'etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2' + dest: '/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf' + owner: 'root' + group: 'root' + mode: 0o644 + + when: 'ansible_facts["os_family"] != "Windows"' + tags: + - 'icinga2_agent' + - 'icinga2_agent:systemd_override' + + - block: # refresh the apt cache so the following `state: latest` upgrade resolves diff --git a/roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 b/roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 new file mode 100644 index 00000000..265ad087 --- /dev/null +++ b/roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 @@ -0,0 +1,5 @@ +# {{ ansible_managed }} +# 2026070301 + +[Unit] +After=sssd.target diff --git a/roles/icinga2_master/README.md b/roles/icinga2_master/README.md index 759217bd..69d747f3 100644 --- a/roles/icinga2_master/README.md +++ b/roles/icinga2_master/README.md @@ -36,6 +36,11 @@ Any [LFOps playbook](https://github.com/Linuxfabrik/lfops/blob/main/playbooks/RE * Manages the state of the Icinga2 service. * Triggers: none. +`icinga2_agent:systemd_override` + +* Deploys: `/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf`. +* Triggers: none. + ## Mandatory Role Variables diff --git a/roles/icinga2_master/tasks/main.yml b/roles/icinga2_master/tasks/main.yml index 2ae8192c..7cb9cbcc 100644 --- a/roles/icinga2_master/tasks/main.yml +++ b/roles/icinga2_master/tasks/main.yml @@ -24,6 +24,30 @@ - 'icinga2_master' +- block: + + - name: 'mkdir -p /etc/systemd/system/icinga2.service.d' + ansible.builtin.file: + path: '/etc/systemd/system/icinga2.service.d' + state: 'directory' + owner: 'root' + group: 'root' + mode: 0o755 + + - name: 'Deploy /etc/systemd/system/icinga2.service.d/z00-after-sssd.conf' + ansible.builtin.template: + backup: true + src: 'etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2' + dest: '/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf' + owner: 'root' + group: 'root' + mode: 0o644 + + tags: + - 'icinga2_master' + - 'icinga2_master:systemd_override' + + - name: 'Perform platform/version specific tasks' ansible.builtin.include_tasks: '{{ __task_file }}' when: '__task_file | length > 0' diff --git a/roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 b/roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 new file mode 100644 index 00000000..265ad087 --- /dev/null +++ b/roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 @@ -0,0 +1,5 @@ +# {{ ansible_managed }} +# 2026070301 + +[Unit] +After=sssd.target From ceba6f71317bb2c66c1ec61000d690d0d099e8b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eric=20B=C3=BCrki?= Date: Fri, 3 Jul 2026 13:59:04 +0200 Subject: [PATCH 2/2] docs(roles/icinga2_agent,roles/icinga2_master): add clarifying comment to systemd drop-in override template --- .../systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 | 3 +++ .../systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 | 3 +++ 2 files changed, 6 insertions(+) diff --git a/roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 b/roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 index 265ad087..793a82bf 100644 --- a/roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 +++ b/roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 @@ -1,5 +1,8 @@ # {{ ansible_managed }} # 2026070301 +# Ensure Icinga 2 starts after SSSD to prevent sudo errors like +# "problem with defaults entries" caused by sudo calls before SSSD is ready. + [Unit] After=sssd.target diff --git a/roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 b/roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 index 265ad087..793a82bf 100644 --- a/roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 +++ b/roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2 @@ -1,5 +1,8 @@ # {{ ansible_managed }} # 2026070301 +# Ensure Icinga 2 starts after SSSD to prevent sudo errors like +# "problem with defaults entries" caused by sudo calls before SSSD is ready. + [Unit] After=sssd.target