diff --git a/deployment/README.md b/deployment/README.md new file mode 100644 index 0000000..a37907b --- /dev/null +++ b/deployment/README.md @@ -0,0 +1,4 @@ +Deployment automation for the CAcert OIDC setup + +This directory contains [Ansible](https://docs.ansible.com) automation code to +install and setup the CAcert OpenID connect components. diff --git a/deployment/ansible.cfg b/deployment/ansible.cfg new file mode 100644 index 0000000..23c9600 --- /dev/null +++ b/deployment/ansible.cfg @@ -0,0 +1,35 @@ +[defaults] +# (boolean) By default Ansible will issue a warning when received from a task action (module or action plugin) +# These warnings can be silenced by adjusting this setting to False. +action_warnings=True + +# (string) Chooses which cache plugin to use, the default 'memory' is ephemeral. +fact_caching=memory + +# (pathlist) Comma separated list of Ansible inventory sources +inventory=inventory/local + +# (pathspec) Colon separated paths in which Ansible will search for Roles. +roles_path=./roles:~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles + +# (boolean) Toggles the use of persistence for connections. +use_persistent_connections=True + +interpreter_python=auto_silent + + +[privilege_escalation] +# (boolean) Display an agnostic become prompt instead of displaying a prompt containing the command line supplied become method +agnostic_become_prompt=True + +# (boolean) This setting controls if become is skipped when remote user and become user are the same. I.E root sudo to root. +# If executable, it will be run and the resulting stdout will be used as the password. +become_allow_same_user=False + + +[diff] +# (bool) Configuration toggle to tell modules to show differences when in 'changed' status, equivalent to ``--diff``. +always=True + +# (integer) How many lines of context to show when displaying the differences between files. +context=3 diff --git a/deployment/inventory/group_vars/all.yml b/deployment/inventory/group_vars/all.yml new file mode 100644 index 0000000..6a325aa --- /dev/null +++ b/deployment/inventory/group_vars/all.yml @@ -0,0 +1,2 @@ +--- +hydra_db_password: hydra diff --git a/deployment/inventory/local b/deployment/inventory/local new file mode 100644 index 0000000..fcb4ffa --- /dev/null +++ b/deployment/inventory/local @@ -0,0 +1,10 @@ +localhost ansible_connection=local + +[pgsqlserver] +localhost + +[authserver] +localhost + +[demoserver] +localhost diff --git a/deployment/playbooks/01_install_cacert_oidc.yml b/deployment/playbooks/01_install_cacert_oidc.yml new file mode 100644 index 0000000..01fc695 --- /dev/null +++ b/deployment/playbooks/01_install_cacert_oidc.yml @@ -0,0 +1,23 @@ +--- +- name: Setup database + hosts: pgsqlserver + become: true + + roles: + - hydra_database + +- name: Install authorization server + hosts: authserver + become: true + + roles: + - hydra_server + - oidc_idp + - oidc_client_registration + +- name: Install demo application + hosts: demoserver + become: true + + roles: + - oidc_demo_application diff --git a/deployment/roles/hydra_database/README.md b/deployment/roles/hydra_database/README.md new file mode 100644 index 0000000..f8ab874 --- /dev/null +++ b/deployment/roles/hydra_database/README.md @@ -0,0 +1,38 @@ +Hydra Database +============== + +Setup a PostgreSQL database for [ORY Hydra](https://ory.sh/hydra/). + +Requirements +------------ + +The role expects a Debian system running Debian 10 or later. + +Role Variables +-------------- + +| Name | Description | Default | +| ------------------- | ----------------- | ------- | +| `hydra_db_name` | Database name | `hydra` | +| `hydra_db_user` | Database user | `hydra` | +| `hydra_db_password` | Database password | - | + + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - hydra_database + +License +------- + +GPL-2.0-or-later + +Author Information +------------------ + +Jan Dittberner diff --git a/deployment/roles/hydra_database/defaults/main.yml b/deployment/roles/hydra_database/defaults/main.yml new file mode 100644 index 0000000..a1770a1 --- /dev/null +++ b/deployment/roles/hydra_database/defaults/main.yml @@ -0,0 +1,3 @@ +--- +hydra_db_name: hydra +hydra_db_user: hydra diff --git a/deployment/roles/hydra_database/handlers/main.yml b/deployment/roles/hydra_database/handlers/main.yml new file mode 100644 index 0000000..d8a9d8e --- /dev/null +++ b/deployment/roles/hydra_database/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for hydra_database diff --git a/deployment/roles/hydra_database/meta/main.yml b/deployment/roles/hydra_database/meta/main.yml new file mode 100644 index 0000000..a20271f --- /dev/null +++ b/deployment/roles/hydra_database/meta/main.yml @@ -0,0 +1,17 @@ +galaxy_info: + author: Jan Dittberner + description: ORY Hydra database setup + company: CAcert + issue_tracker_url: https://code.cacert.org/cacert/oidc-parent/issues + license: GPL-2.0-or-later + min_ansible_version: 2.1 + platforms: + - name: Debian + versions: + - buster + - bullseye + - bookworm + + galaxy_tags: [] + +dependencies: [] diff --git a/deployment/roles/hydra_database/tasks/main.yml b/deployment/roles/hydra_database/tasks/main.yml new file mode 100644 index 0000000..c5bc6d3 --- /dev/null +++ b/deployment/roles/hydra_database/tasks/main.yml @@ -0,0 +1,29 @@ +--- +- name: Install PostgreSQL server + ansible.builtin.package: + name: postgresql + state: present + +- name: Create Hydra database + community.postgresql.postgresql_db: + name: "{{ hydra_db_name }}" + encoding: UTF-8 + template: template0 + state: present + become_user: postgres + +- name: Create Hydra database user + community.postgresql.postgresql_user: + name: "{{ hydra_db_user }}" + password: "{{ hydra_db_password }}" + state: present + become_user: postgres + +- name: Grant permissions on Hydra database to Hydra database user + community.postgresql.postgresql_privs: + database: "{{ hydra_db_name }}" + state: present + privs: CREATE,CONNECT + type: database + role: "{{ hydra_db_user }}" + become_user: postgres diff --git a/deployment/roles/hydra_server/README.md b/deployment/roles/hydra_server/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/deployment/roles/hydra_server/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/deployment/roles/hydra_server/defaults/main.yml b/deployment/roles/hydra_server/defaults/main.yml new file mode 100644 index 0000000..357e185 --- /dev/null +++ b/deployment/roles/hydra_server/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for roles/hydra_server diff --git a/deployment/roles/hydra_server/handlers/main.yml b/deployment/roles/hydra_server/handlers/main.yml new file mode 100644 index 0000000..018486d --- /dev/null +++ b/deployment/roles/hydra_server/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for roles/hydra_server diff --git a/deployment/roles/hydra_server/meta/main.yml b/deployment/roles/hydra_server/meta/main.yml new file mode 100644 index 0000000..18848a7 --- /dev/null +++ b/deployment/roles/hydra_server/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: Jan Dittberner + description: Setup ORY Hydra server + company: CAcert + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: GPL-2.0-or-later + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/deployment/roles/hydra_server/tasks/main.yml b/deployment/roles/hydra_server/tasks/main.yml new file mode 100644 index 0000000..ae54d2a --- /dev/null +++ b/deployment/roles/hydra_server/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# tasks file for roles/hydra_server diff --git a/deployment/roles/hydra_server/vars/main.yml b/deployment/roles/hydra_server/vars/main.yml new file mode 100644 index 0000000..189ec15 --- /dev/null +++ b/deployment/roles/hydra_server/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for roles/hydra_server diff --git a/deployment/roles/oidc_client_registration/README.md b/deployment/roles/oidc_client_registration/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/deployment/roles/oidc_client_registration/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/deployment/roles/oidc_client_registration/defaults/main.yml b/deployment/roles/oidc_client_registration/defaults/main.yml new file mode 100644 index 0000000..ca4b246 --- /dev/null +++ b/deployment/roles/oidc_client_registration/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for roles/oidc_client_registration diff --git a/deployment/roles/oidc_client_registration/handlers/main.yml b/deployment/roles/oidc_client_registration/handlers/main.yml new file mode 100644 index 0000000..f9ded04 --- /dev/null +++ b/deployment/roles/oidc_client_registration/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for roles/oidc_client_registration diff --git a/deployment/roles/oidc_client_registration/meta/main.yml b/deployment/roles/oidc_client_registration/meta/main.yml new file mode 100644 index 0000000..c572acc --- /dev/null +++ b/deployment/roles/oidc_client_registration/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/deployment/roles/oidc_client_registration/tasks/main.yml b/deployment/roles/oidc_client_registration/tasks/main.yml new file mode 100644 index 0000000..8662f7a --- /dev/null +++ b/deployment/roles/oidc_client_registration/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# tasks file for roles/oidc_client_registration diff --git a/deployment/roles/oidc_client_registration/vars/main.yml b/deployment/roles/oidc_client_registration/vars/main.yml new file mode 100644 index 0000000..188961d --- /dev/null +++ b/deployment/roles/oidc_client_registration/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for roles/oidc_client_registration diff --git a/deployment/roles/oidc_demo_application/README.md b/deployment/roles/oidc_demo_application/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/deployment/roles/oidc_demo_application/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/deployment/roles/oidc_demo_application/defaults/main.yml b/deployment/roles/oidc_demo_application/defaults/main.yml new file mode 100644 index 0000000..a344905 --- /dev/null +++ b/deployment/roles/oidc_demo_application/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for roles/oidc_demo_application diff --git a/deployment/roles/oidc_demo_application/handlers/main.yml b/deployment/roles/oidc_demo_application/handlers/main.yml new file mode 100644 index 0000000..29cefff --- /dev/null +++ b/deployment/roles/oidc_demo_application/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for roles/oidc_demo_application diff --git a/deployment/roles/oidc_demo_application/meta/main.yml b/deployment/roles/oidc_demo_application/meta/main.yml new file mode 100644 index 0000000..c572acc --- /dev/null +++ b/deployment/roles/oidc_demo_application/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/deployment/roles/oidc_demo_application/tasks/main.yml b/deployment/roles/oidc_demo_application/tasks/main.yml new file mode 100644 index 0000000..d02ffeb --- /dev/null +++ b/deployment/roles/oidc_demo_application/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# tasks file for roles/oidc_demo_application diff --git a/deployment/roles/oidc_demo_application/vars/main.yml b/deployment/roles/oidc_demo_application/vars/main.yml new file mode 100644 index 0000000..b973543 --- /dev/null +++ b/deployment/roles/oidc_demo_application/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for roles/oidc_demo_application diff --git a/deployment/roles/oidc_idp/README.md b/deployment/roles/oidc_idp/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/deployment/roles/oidc_idp/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/deployment/roles/oidc_idp/defaults/main.yml b/deployment/roles/oidc_idp/defaults/main.yml new file mode 100644 index 0000000..3f81055 --- /dev/null +++ b/deployment/roles/oidc_idp/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for roles/oidc_idp diff --git a/deployment/roles/oidc_idp/handlers/main.yml b/deployment/roles/oidc_idp/handlers/main.yml new file mode 100644 index 0000000..abef7bb --- /dev/null +++ b/deployment/roles/oidc_idp/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for roles/oidc_idp diff --git a/deployment/roles/oidc_idp/meta/main.yml b/deployment/roles/oidc_idp/meta/main.yml new file mode 100644 index 0000000..c572acc --- /dev/null +++ b/deployment/roles/oidc_idp/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/deployment/roles/oidc_idp/tasks/main.yml b/deployment/roles/oidc_idp/tasks/main.yml new file mode 100644 index 0000000..3ea98dc --- /dev/null +++ b/deployment/roles/oidc_idp/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# tasks file for roles/oidc_idp diff --git a/deployment/roles/oidc_idp/vars/main.yml b/deployment/roles/oidc_idp/vars/main.yml new file mode 100644 index 0000000..7533e99 --- /dev/null +++ b/deployment/roles/oidc_idp/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for roles/oidc_idp