|
| 1 | +# Rabbitmq Playbook |
| 2 | + |
| 3 | +HelloFresh extension of the RabbitMQ playbook which allows clustering. Originally written by [Mayeu](https://github.com/Mayeu/ansible-playbook-rabbitmq). |
| 4 | + |
| 5 | +Playbook to install and configure rabbitmq. Will come with various |
| 6 | +configuration tweaking later on. |
| 7 | + |
| 8 | +If you wish to discuss modifications, or help to support more platforms, open |
| 9 | +an issue. |
| 10 | + |
| 11 | +### Environment |
| 12 | + |
| 13 | +|Name|Type|Description|Default| |
| 14 | +|----|----|-----------|-------| |
| 15 | +`rabbitmq_conf_env`|Hash|Set environment variable|undef| |
| 16 | + |
| 17 | +Example: |
| 18 | + |
| 19 | +```yaml |
| 20 | +rabbitmq_conf_env: |
| 21 | + RABBITMQ_ROCKS: correct |
| 22 | +``` |
| 23 | +
|
| 24 | +Will generate: |
| 25 | +
|
| 26 | +``` |
| 27 | +RABBITMQ_ROCKS="correct" |
| 28 | +``` |
| 29 | + |
| 30 | +### Certificate |
| 31 | + |
| 32 | +|Name|Type|Description|Default| |
| 33 | +|----|----|-----------|-------| |
| 34 | +`rabbitmq_cacert`|String|Path of the CA certificate file.|`files/rabbitmq_cacert.pem` |
| 35 | +`rabbitmq_server_key`|String|Path of the SSL key file.|`files/rabbitmq_server_key.pem` |
| 36 | +`rabbitmq_server_cert`|String|Path of the SSL certificate file.|`files/rabbitmq_server_cert.pem` |
| 37 | +`rabbitmq_ssl`|Boolean|Define if we need to use SSL|`true` |
| 38 | + |
| 39 | +### Default configuration file |
| 40 | + |
| 41 | +|Name|Type|Description|Default| |
| 42 | +|----|----|-----------|-------| |
| 43 | +`rabbitmq_conf_tcp_listeners_address`|String|listening address for the tcp interface|`''` |
| 44 | +`rabbitmq_conf_tcp_listeners_port`|Integer|listening port for the tcp interface|`5672` |
| 45 | +`rabbitmq_conf_ssl_listeners_address`|String|listening address for the ssl interface|`'0.0.0.0'` |
| 46 | +`rabbitmq_conf_ssl_listeners_port`|Integer|listening port for the ssl interface|`5671` |
| 47 | +`rabbitmq_conf_ssl_options_cacertfile`|String|Path the CA certificate|`"/etc/rabbitmq/ssl/cacert.pem"` |
| 48 | +`rabbitmq_conf_ssl_options_certfile`|String|Path to the server certificate|`"/etc/rabbitmq/ssl/server_cert.pem"` |
| 49 | +`rabbitmq_conf_ssl_options_keyfile`|String|Path to the private key file|`"/etc/rabbitmq/ssl/server_key.pem"` |
| 50 | +`rabbitmq_conf_ssl_options_fail_if_no_peer_cert`|Boolean|Value of the `fail_if_no_peer_cert` SSL option|`"true"` |
| 51 | + |
| 52 | +### Plugins |
| 53 | + |
| 54 | +|Name|Type|Description|Default| |
| 55 | +|----|----|-----------|-------| |
| 56 | +`rabbitmq_new_only`|String|Add plugins as new, without deactivating other plugins|`'no'` |
| 57 | +`rabbitmq_plugins`|String|List|List of plugins to activate|`[]` |
| 58 | + |
| 59 | +### Vhost |
| 60 | + |
| 61 | +|Name|Type|Description|Default| |
| 62 | +|----|----|-----------|-------| |
| 63 | +`rabbitmq_vhost_definitions`|List|Define the list of vhost to create|`[]` |
| 64 | +`rabbitmq_users_definitions`|List of hash|Define the users, and associated vhost and password (see below)|`[]` |
| 65 | + |
| 66 | +Defining the vhosts configuration |
| 67 | + |
| 68 | +```yaml |
| 69 | +rabbitmq_vhost_definitions: |
| 70 | + - name: vhost1 |
| 71 | + node: node_name #Optional, defaults to "rabbit" |
| 72 | + tracing: yes #Optional, defaults to "no" |
| 73 | +``` |
| 74 | +
|
| 75 | +Defining the users configuration: |
| 76 | +
|
| 77 | +```yaml |
| 78 | +rabbitmq_users_definitions: |
| 79 | + - vhost: vhost1 |
| 80 | + user: user1 |
| 81 | + password: password1 |
| 82 | + node: node_name # Optional, defaults to "rabbit" |
| 83 | + configure_priv: "^resource.*" # Optional, defaults to ".*" |
| 84 | + read_priv: "^$" # Disallow reading. |
| 85 | + write_priv: "^$" # Disallow writing. |
| 86 | + - vhost: vhost1 |
| 87 | + user: user2 |
| 88 | + password: password2 |
| 89 | + force: no |
| 90 | + tags: # Optional, user tags |
| 91 | + - administrator |
| 92 | +``` |
| 93 | +
|
| 94 | +## Cluster |
| 95 | +
|
| 96 | +# Limitations |
| 97 | +If you remove a node from inventory and node is still running it will not be removed |
| 98 | +
|
| 99 | +### Federation |
| 100 | +
|
| 101 | +|Name|Type|Description|Default| |
| 102 | +|----|----|-----------|-------| |
| 103 | +`rabbitmq_federation`|Boolean|Define if we need to setup federation|`false` |
| 104 | +`rabbitmq_federation_configuration`|List of hashes|Define all the federation we need to setup|Not defined |
| 105 | +`rabbitmq_policy_configuration`|List of hashes|Define all the federation we need to setup|Not defined |
| 106 | + |
| 107 | +Defining the federation upstream configuration: |
| 108 | + |
| 109 | +```yaml |
| 110 | +rabbitmq_federation_upstream: |
| 111 | + - name: upstream name |
| 112 | + vhost: local vhost to federate |
| 113 | + value: json description of the federation |
| 114 | + local_username: the local username for the federation |
| 115 | +``` |
| 116 | + |
| 117 | +See the [RabbitMQ documentation](http://www.rabbitmq.com/federation.html) for |
| 118 | +the possible JSON value. |
| 119 | + |
| 120 | +Defining the policy configuration: |
| 121 | + |
| 122 | +```yaml |
| 123 | +rabbitmq_policy_configuration: |
| 124 | + - name: name of the policy |
| 125 | + vhost: vhost where the policy will be applied |
| 126 | + pattern: pattern of the policy |
| 127 | + tags: description of the policy in dict form # exemple: "ha-mode=all" |
| 128 | +``` |
| 129 | + |
| 130 | +## Files required |
| 131 | + |
| 132 | +You have to put the needed certificates in your `files/` folder, for example: |
| 133 | + |
| 134 | + files/ |
| 135 | + |- cacert.crt |
| 136 | + |- myserver_key.key |
| 137 | + |- myserver_cert.crt |
| 138 | + |
| 139 | +And then configure the role: |
| 140 | + |
| 141 | +```yaml |
| 142 | + rabbitmq_cacert: files/cacert.crt |
| 143 | + rabbitmq_server_key: files/myserver_key.key |
| 144 | + rabbitmq_server_cert: files/myserver_cert.crt |
| 145 | +``` |
| 146 | + |
| 147 | +## Variables |
| 148 | + |
| 149 | +```yaml |
| 150 | +# Take the package given by the OS/distrib |
| 151 | +rabbitmq_os_package : false |
| 152 | +
|
| 153 | +# Plugins |
| 154 | +rabbitmq_plugins : [] |
| 155 | +rabbitmq_new_only : 'no' |
| 156 | +
|
| 157 | +# VHOST |
| 158 | +rabbitmq_vhost_definitions : [] |
| 159 | +rabbitmq_users_definitions : [] |
| 160 | +
|
| 161 | +# Avoid setting up federation |
| 162 | +rabbitmq_federation : false |
| 163 | +
|
| 164 | +# defaults file for rabbitmq |
| 165 | +rabbitmq_cacert : "files/rabbitmq_cacert.pem" |
| 166 | +rabbitmq_server_key : "files/rabbitmq_server_key.pem" |
| 167 | +rabbitmq_server_cert : "files/rabbitmq_server_cert.pem" |
| 168 | +rabbitmq_ssl : true |
| 169 | +
|
| 170 | +## Optional logging |
| 171 | +## none, error, warnings, info, debug |
| 172 | +# rabbitmq_log_level : |
| 173 | +# channel : error |
| 174 | +# connection : error |
| 175 | +# federation : error |
| 176 | +# mirroring : error |
| 177 | +
|
| 178 | +# ###################### |
| 179 | +# RabbitMQ Configuration |
| 180 | +# ###################### |
| 181 | +
|
| 182 | +# rabbitmq TCP configuration |
| 183 | +rabbitmq_conf_tcp_listeners_address : '0.0.0.0' |
| 184 | +rabbitmq_conf_tcp_listeners_port : 5672 |
| 185 | +
|
| 186 | +# rabbitmq SSL configuration |
| 187 | +rabbitmq_conf_ssl_listeners_address : '0.0.0.0' |
| 188 | +rabbitmq_conf_ssl_listeners_port : 5671 |
| 189 | +rabbitmq_conf_ssl_options_cacertfile : "/etc/rabbitmq/ssl/{{ rabbitmq_cacert | basename }}" |
| 190 | +rabbitmq_conf_ssl_options_certfile : "/etc/rabbitmq/ssl/{{ rabbitmq_server_cert | basename }}" |
| 191 | +rabbitmq_conf_ssl_options_keyfile : "/etc/rabbitmq/ssl/{{ rabbitmq_server_key | basename }}" |
| 192 | +rabbitmq_conf_ssl_options_fail_if_no_peer_cert: "true" |
| 193 | +
|
| 194 | +rabbitmq_env : false |
| 195 | +# Guest options |
| 196 | +remove_guest_user : true |
| 197 | +
|
| 198 | +# Enable cluster |
| 199 | +rabbitmq_clustering : false |
| 200 | +## Erlang cookie |
| 201 | +rabbitmq_erlang_cookie_path : "/var/lib/rabbitmq/.erlang.cookie" |
| 202 | +rabbitmq_erlang_cookie : beKSqkmoLrtvVfjOytLOQpATbGVEGbVA #test cookie, override for production |
| 203 | +## Cluster options |
| 204 | +rabbitmq_cluster_instance_to_join_index : 0 |
| 205 | +rabbitmq_cluster_instance_to_join : "{{ groups[rabbitmq_cluster_group][rabbitmq_cluster_instance_to_join_index].split('.')[0] }}" |
| 206 | +rabbitmq_cluster_group : rabbit_cluster |
| 207 | +rabbitmq_cluster_post_fix_domain : "production.example.com" |
| 208 | +# Automation user for cluster. You should encrypt |
| 209 | +rabbitmq_cluster_api_user : "api-automation" |
| 210 | +rabbitmq_cluster_api_password : "api-password" |
| 211 | +
|
| 212 | +# How to get the IPs of cluster |
| 213 | +rabbitmq_clustering_resolve_names : "ansible" # ['ansible', dns] |
| 214 | +
|
| 215 | +## Probably dont need to change that stuff |
| 216 | +### Construct a regex to match group before . |
| 217 | +rabbitmq_cluster_post_fix_domain_regex_replace: "([^.]*).*" |
| 218 | +# Print extra message related to inventory |
| 219 | +rabbitmq_cluster_debug : false |
| 220 | +``` |
| 221 | + |
| 222 | +## Testing |
| 223 | + |
| 224 | +## License |
| 225 | + |
| 226 | +BSD |
| 227 | + |
| 228 | +<p align="center"> |
| 229 | + <a href="https://hellofresh.com"> |
| 230 | + <img width="120" src="https://www.hellofresh.de/images/hellofresh/press/HelloFresh_Logo.png"> |
| 231 | + </a> |
| 232 | +</p> |
0 commit comments