224 lines
8.7 KiB
YAML
224 lines
8.7 KiB
YAML
---
|
|
- name: Load secret values
|
|
hosts: "console"
|
|
gather_facts: false
|
|
become: false
|
|
tasks:
|
|
- name: Load secret from secrets.yaml
|
|
ansible.builtin.include_role:
|
|
name: "console"
|
|
tasks_from: "node/load_secret_vars"
|
|
apply:
|
|
tags: ["always"]
|
|
tags: ["always"]
|
|
|
|
- name: Site console
|
|
hosts: "console"
|
|
gather_facts: false
|
|
become: false
|
|
tasks:
|
|
- name: Create root CA
|
|
tags: ["never", "root"]
|
|
block:
|
|
- name: Clean previous CA temporary directory
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/ca"
|
|
state: "absent"
|
|
no_log: true
|
|
- name: Create ca directory
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/ca"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
state: "directory"
|
|
mode: "0700"
|
|
- name: Get root CA password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{{ hostvars['console']['ca']['root']['password'] }}
|
|
dest: "/run/user/{{ node['uid'] }}/ca/root_ca.password"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0400"
|
|
no_log: true
|
|
- name: Create root CA
|
|
ansible.builtin.command: |
|
|
step certificate create \
|
|
"{{ domain['internal'] }} Root CA" \
|
|
/run/user/{{ node['uid'] }}/ca/root_ca.crt \
|
|
/run/user/{{ node['uid'] }}/ca/root_ca.key \
|
|
--password-file /run/user/{{ node['uid'] }}/ca/root_ca.password \
|
|
--profile root-ca \
|
|
--not-after 87600h
|
|
changed_when: true
|
|
no_log: true
|
|
- name: Update root CA
|
|
environment:
|
|
SOPS_AGE_KEY: "{{ hostvars['console']['age_key'] }}"
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
jq -Rs . "/run/user/{{ node['uid'] }}/ca/root_ca.crt" \
|
|
| sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
|
|
'["ca"]["root"]["crt"]'
|
|
jq -Rs . "/run/user/{{ node['uid'] }}/ca/root_ca.key" \
|
|
| sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
|
|
'["ca"]["root"]["key"]'
|
|
changed_when: true
|
|
no_log: true
|
|
always:
|
|
- name: Clean temporary files
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/ca"
|
|
state: "absent"
|
|
no_log: true
|
|
|
|
- name: Get root CA and create intermediate CA
|
|
tags: ["never", "intermediate"]
|
|
block:
|
|
- name: Clean previous CA temporary directory
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/ca"
|
|
state: "absent"
|
|
no_log: true
|
|
- name: Create ca certificates directory
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/ca"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
state: "directory"
|
|
mode: "0700"
|
|
- name: Get root key and cert and password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{{ hostvars['console']['ca']['root'][item] }}
|
|
dest: "/run/user/{{ node['uid'] }}/ca/root_ca.{{ item }}"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0400"
|
|
loop:
|
|
- "key"
|
|
- "crt"
|
|
- "password"
|
|
no_log: true
|
|
- name: Get intermediate CA password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{{ hostvars['console']['ca']['intermediate']['password'] }}
|
|
dest: "/run/user/{{ node['uid'] }}/ca/intermediate_ca.password"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0400"
|
|
no_log: true
|
|
- name: Create intermediate CA
|
|
ansible.builtin.command: |
|
|
step certificate create \
|
|
"{{ domain['internal'] }} intermediate CA" \
|
|
/run/user/{{ node['uid'] }}/ca/intermediate_ca.crt \
|
|
/run/user/{{ node['uid'] }}/ca/intermediate_ca.key \
|
|
--password-file /run/user/{{ node['uid'] }}/ca/intermediate_ca.password \
|
|
--profile intermediate-ca \
|
|
--ca /run/user/{{ node['uid'] }}/ca/root_ca.crt \
|
|
--ca-key /run/user/{{ node['uid'] }}/ca/root_ca.key \
|
|
--ca-password-file /run/user/{{ node['uid'] }}/ca/root_ca.password \
|
|
--not-after 43800h
|
|
changed_when: true
|
|
no_log: true
|
|
- name: Update intermediate CA
|
|
environment:
|
|
SOPS_AGE_KEY: "{{ hostvars['console']['age_key'] }}"
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
jq -Rs . "/run/user/{{ node['uid'] }}/ca/intermediate_ca.crt" \
|
|
| sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
|
|
'["ca"]["intermediate"]["crt"]'
|
|
jq -Rs . "/run/user/{{ node['uid'] }}/ca/intermediate_ca.key" \
|
|
| sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
|
|
'["ca"]["intermediate"]["key"]'
|
|
changed_when: true
|
|
no_log: true
|
|
always:
|
|
- name: Clean temporary files
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/ca"
|
|
state: "absent"
|
|
no_log: true
|
|
|
|
- name: Get intermediate CA and create leaf cert
|
|
tags: ["never", "leaf"]
|
|
block:
|
|
- name: Initialize self-cert services list
|
|
ansible.builtin.set_fact:
|
|
cert_services: []
|
|
- name: Set self-cert services list
|
|
ansible.builtin.set_fact:
|
|
cert_services: >-
|
|
{{
|
|
services
|
|
| dict2items
|
|
| selectattr('value.dependency.cert', 'defined')
|
|
| selectattr('value.dependency.cert', 'equalto', true)
|
|
| map(attribute='key')
|
|
| list
|
|
}}
|
|
- name: Clean previous leaf temporary directory
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/leaf"
|
|
state: "absent"
|
|
no_log: true
|
|
- name: Create leaf certificates directory
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/leaf"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
state: "directory"
|
|
mode: "0700"
|
|
- name: Get intermediate key and cert and password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{{ hostvars['console']['ca']['intermediate'][item] }}
|
|
dest: "/run/user/{{ node['uid'] }}/leaf/intermediate_ca.{{ item }}"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0400"
|
|
loop:
|
|
- "key"
|
|
- "crt"
|
|
- "password"
|
|
no_log: true
|
|
- name: Create leaf certificates
|
|
ansible.builtin.command: |
|
|
step certificate create \
|
|
"{{ services[item]['domain']['internal'] }}.{{ domain['internal'] }}" \
|
|
/run/user/{{ node['uid'] }}/leaf/{{ item }}.crt \
|
|
/run/user/{{ node['uid'] }}/leaf/{{ item }}.key \
|
|
--profile leaf \
|
|
--san {{ services[item]['domain']['internal'] }}.{{ domain['internal'] }} \
|
|
--ca /run/user/{{ node['uid'] }}/leaf/intermediate_ca.crt \
|
|
--ca-key /run/user/{{ node['uid'] }}/leaf/intermediate_ca.key \
|
|
--ca-password-file /run/user/{{ node['uid'] }}/leaf/intermediate_ca.password \
|
|
--not-after 21900h \
|
|
--insecure --no-password
|
|
loop: "{{ cert_services }}"
|
|
changed_when: true
|
|
no_log: true
|
|
- name: Update leaf keys and certificates
|
|
environment:
|
|
SOPS_AGE_KEY: "{{ hostvars['console']['age_key'] }}"
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
jq -Rs . "/run/user/{{ node['uid'] }}/leaf/{{ item }}.crt" \
|
|
| sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
|
|
'["{{ item }}"]["crt"]'
|
|
jq -Rs . "/run/user/{{ node['uid'] }}/leaf/{{ item }}.key" \
|
|
| sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
|
|
'["{{ item }}"]["key"]'
|
|
loop: "{{ cert_services }}"
|
|
changed_when: true
|
|
no_log: true
|
|
always:
|
|
- name: Clean temporary files
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ node['uid'] }}/leaf"
|
|
state: "absent"
|
|
no_log: true
|