zpa_app_connector_plus_STIG_RHEL8.yml

# Requires the RHEL 8 STIG Ansible Role to be installed on the host running this playbook
# ansible-galaxy install redhatofficial.rhel8_stig
# Be sure to fill in your ZPA provisioning key in the "Create provisioning key task"
# Create the zscaler-repo file in your local directory with the following content:
#   [zscaler]
#   name=Zscaler Private Access Repository
#   baseurl=https://yum.private.zscaler.com/yum/el7
#   enabled=1
#   gpgcheck=1
#   gpgkey=https://yum.private.zscaler.com/gpg
---

- name: Configure ZPA App Connectors
  hosts: localhost
  remote_user: sam

  tasks:
  - name: Copy App Connector Repo File to server
    copy:
      src: ./zscaler-repo
      dest: /etc/yum.repos.d/zscaler.repo
    become: yes

  - name: Install App Connector RPM
    yum:
      name: zpa-connector
      state: present
    become: yes
  - name: Stop App Connector
    ansible.builtin.service:
      name: zpa-connector
      state: stopped
    become: yes
  - name: Create gov flag file
    copy:
      content: ""
      dest: /opt/zscaler/var/gov
      force: no
      group: sys
      owner: root
      mode: 0644
    become: yes
  - name: Create provisioning key
    copy:
      content: "<FILL IN PROVISIONING KEY HERE>"
      dest: /opt/zscaler/var/provision_key
      force: no
      group: sys
      owner: root
      mode: 0644
    become: yes
  - name: Start App Connector
    ansible.builtin.service:
      name: zpa-connector
      state: started
    become: yes
  - name: STIG the box
    include_role:
      name: redhatofficial.rhel8_stig
  - name: Stop App Connector
    ansible.builtin.service:
      name: zpa-connector
      state: stopped
    become: yes
  - name: Stop fapolicyd
    ansible.builtin.service:
      name: fapolicyd
      state: stopped
    become: yes

  - name: Add exception to fapolicyd for Zscaler binaries
    blockinfile:
      path: "/etc/fapolicyd/fapolicyd.rules"
      insertbefore: '# Carve out an exception for dracut initramfs building'
      block: |
        # Add exception for Zscaler binaries to allow upgrades to succeed
        allow perm=any trust=1 : dir=/opt/zscaler/ all trust=0
    become: yes
  - name: Start fapolicyd
    ansible.builtin.service:
      name: fapolicyd
      state: started
    become: yes

  - name: Start App Connector
    ansible.builtin.service:
      name: zpa-connector
      state: started
    become: yes
  - name: Reboot Server
    reboot: