feat(roles/icinga2_agent,roles/icinga2_master): deploy a systemd drop…

CHANGELOG.md

@@ -23,6 +23,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+* **role:icinga2_agent, role:icinga2_master**: Deploy a systemd drop-in override ensuring the Icinga 2 service starts after SSSD on hosts where SSSD is installed.
 * **role:librenms**: Add `librenms__config_app_trusted_proxies` and `librenms__config_app_url` to set the `APP_TRUSTED_PROXIES` and `APP_URL` variables in `/opt/librenms/.env`, needed when running LibreNMS behind a reverse proxy.
 * **role:mariadb_server**: Add `mariadb_server__cnf_innodb_flush_neighbors__group_var` / `__host_var` to configure the `innodb_flush_neighbors` InnoDB system variable. Defaults to `0` (disabled), which is the recommended value for SSD/NVMe storage.
 * **role:freeipa_server**: Add `freeipa_server__limit_groups`, `freeipa_server__limit_hbacrules`, `freeipa_server__limit_hostgroups`, `freeipa_server__limit_pwpolicies`, `freeipa_server__limit_sudocmdgroups`, `freeipa_server__limit_sudocmds`, `freeipa_server__limit_sudorules` and `freeipa_server__limit_users` to manage only specific resources via `--extra-vars` instead of all of them, e.g. `--tags freeipa_server:users --extra-vars='freeipa_server__limit_users=["jdoe"]'`. Speeds up deployments on servers with many FreeIPA resources.

roles/icinga2_agent/README.md

@@ -44,6 +44,11 @@ Manual steps:
 * Manages the state of the Icinga2 service.
 * Triggers: none.
 
+`icinga2_agent:systemd_override`
+
+* Deploys: `/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf`.
+* Triggers: none.
+
 `icinga2_agent:update`
 
 * Updates the Icinga2 package and restarts the service.

roles/icinga2_agent/tasks/main.yml

@@ -10,6 +10,31 @@
     - 'icinga2_agent'
 
 
+- block:
+
+  - name: 'mkdir -p /etc/systemd/system/icinga2.service.d'
+    ansible.builtin.file:
+      path: '/etc/systemd/system/icinga2.service.d'
+      state: 'directory'
+      owner: 'root'
+      group: 'root'
+      mode: 0o755
+
+  - name: 'Deploy /etc/systemd/system/icinga2.service.d/z00-after-sssd.conf'
+    ansible.builtin.template:
+      backup: true
+      src: 'etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2'
+      dest: '/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf'
+      owner: 'root'
+      group: 'root'
+      mode: 0o644
+
+  when: 'ansible_facts["os_family"] != "Windows"'
+  tags:
+    - 'icinga2_agent'
+    - 'icinga2_agent:systemd_override'
+
+
 - block:
 
   # refresh the apt cache so the following `state: latest` upgrade resolves

roles/icinga2_agent/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+# 2026070301
+
+# Ensure Icinga 2 starts after SSSD to prevent sudo errors like
+# "problem with defaults entries" caused by sudo calls before SSSD is ready.
+
+[Unit]
+After=sssd.target

roles/icinga2_master/README.md

@@ -36,6 +36,11 @@ Any [LFOps playbook](https://github.com/Linuxfabrik/lfops/blob/main/playbooks/RE
 * Manages the state of the Icinga2 service.
 * Triggers: none.
 
+`icinga2_agent:systemd_override`
+
+* Deploys: `/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf`.
+* Triggers: none.
+
 
 ## Mandatory Role Variables
 

roles/icinga2_master/tasks/main.yml

@@ -24,6 +24,30 @@
     - 'icinga2_master'
 
 
+- block:
+
+  - name: 'mkdir -p /etc/systemd/system/icinga2.service.d'
+    ansible.builtin.file:
+      path: '/etc/systemd/system/icinga2.service.d'
+      state: 'directory'
+      owner: 'root'
+      group: 'root'
+      mode: 0o755
+
+  - name: 'Deploy /etc/systemd/system/icinga2.service.d/z00-after-sssd.conf'
+    ansible.builtin.template:
+      backup: true
+      src: 'etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2'
+      dest: '/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf'
+      owner: 'root'
+      group: 'root'
+      mode: 0o644
+
+  tags:
+    - 'icinga2_master'
+    - 'icinga2_master:systemd_override'
+
+
 - name: 'Perform platform/version specific tasks'
   ansible.builtin.include_tasks: '{{ __task_file }}'
   when: '__task_file | length > 0'

roles/icinga2_master/templates/etc/systemd/system/icinga2.service.d/z00-after-sssd.conf.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+# 2026070301
+
+# Ensure Icinga 2 starts after SSSD to prevent sudo errors like
+# "problem with defaults entries" caused by sudo calls before SSSD is ready.
+
+[Unit]
+After=sssd.target