setup papertrail logging on managed hosts and sslproxy container

dockerfiles/sslproxy/docker-compose.yml

@@ -24,6 +24,12 @@ services:
 #      options:
 #        gelf-address: "udp://logs.xai-corp.net:12201"
 
+    logging:
+      driver: syslog
+      options:
+        syslog-address: "tcp+tls://logs6.papertrailapp.com:38577"
+        tag: "{{.Name}}/{{.ID}}"
+
     deploy:
       mode: replicated
       replicas: 1

managed_setup.yml

@@ -35,22 +35,23 @@
     - users_groups:
 
     - datadog_api_key: ca0faf176c4aedd4f547ed7cf85615eb
-          datadog_checks:
+    - datadog_checks:
-            system:
+        system:
-              init_config: []
+          init_config: []
-              instances: []
+          instances: []
-            disk:
+        disk:
-              init_config:
+          init_config:
-              instances:
+          instances:
-                  - use_mount: yes
+              - use_mount: yes
-                    excluded_filesystems:
+                excluded_filesystems:
-                      - sysfs
+                  - sysfs
-                      - cgroup
+                  - cgroup
-                      - tracefs
+                  - tracefs
-                      - debugfs
+                  - debugfs
-                      - proc
+                  - proc
-                      - securityfs
+                  - securityfs
-                    excluded_mountpoint_re: /[media/richard|run/user].*
+                  - shm
+                excluded_mountpoint_re: /[media/richard|run/user].*
 
 
     - rsyslog:
@@ -58,7 +59,7 @@
         group: root
         service: rsyslog
         configs:
-          - 49-shiptograylog
+          - 48-ship2papertrail
 
   # prepare python for ansible
   pre_tasks:
@@ -79,6 +80,7 @@
     - novuso.users
     - user-richard
     - rsyslog
+    - motd
     - { role: Datadog.datadog, when: ansible_architecture != 'armv7l' } #does not support armhf architecture. should switch to fluentd or logstash
 
   tasks:

managed_updates.yml

@@ -25,6 +25,7 @@
                 - debugfs
                 - proc
                 - securityfs
+                - shm
               excluded_mountpoint_re: /[media/richard|run/user].*
 
   roles:

roles/ns.xai-corp.net/tasks/main.yml

@@ -6,6 +6,7 @@
   apt:
     name: "{{ item }}"
     update_cache: yes
+    cache_valid_time: 86400
     state: latest
   with_items:
     - bind9

roles/rsyslog/tasks/main.yml

@@ -3,6 +3,22 @@
 
 - debug: var=rsyslog
 
+- name: remove packages
+  apt:
+    state: present
+    name: "{{item}}"
+    update_cache: yes
+    cache_valid_time: 86400
+  with_items:
+    - rsyslog-gnutls
+
+- name: copy tls certs for papertrail
+  get_url:
+    url: https://papertrailapp.com/tools/papertrail-bundle.pem
+    dest: /etc/papertrail-bundle.pem
+    force: yes
+    mode: 0644
+
 - name: copy custom configs
   template:
     src: "{{ item }}.j2"

roles/rsyslog/templates/48-ship2papertrail.j2

@@ -0,0 +1,7 @@
+$DefaultNetstreamDriverCAFile /etc/papertrail-bundle.pem # trust these CAs
+$ActionSendStreamDriver gtls # use gtls netstream driver
+$ActionSendStreamDriverMode 1 # require TLS
+$ActionSendStreamDriverAuthMode x509/name # authenticate by hostname
+$ActionSendStreamDriverPermittedPeer *.papertrailapp.com
+
+*.*    @@logs6.papertrailapp.com:38577