Jan Dittberner
2bfa210140
- Deploy cacert-idp from oidc_idp subdirectory - configure systemd and start cacert-idp service
111 lines
3.1 KiB
YAML
111 lines
3.1 KiB
YAML
---
|
|
- name: Create CAcert group
|
|
ansible.builtin.group:
|
|
name: "{{ cacert_os_group }}"
|
|
state: present
|
|
system: true
|
|
|
|
- name: Create CAcert user
|
|
ansible.builtin.user:
|
|
name: "{{ cacert_os_user }}"
|
|
group: "{{ cacert_os_group }}"
|
|
home: "{{ cacert_home }}"
|
|
state: present
|
|
system: true
|
|
|
|
- name: Create CAcert directories
|
|
ansible.builtin.file:
|
|
path: "{{ cacert_home }}/{{ item.path }}"
|
|
owner: "{{ cacert_os_user }}"
|
|
group: "{{ cacert_os_group }}"
|
|
mode: "{{ item.mode }}"
|
|
state: directory
|
|
loop:
|
|
- { path: etc, mode: '0750' }
|
|
- { path: bin, mode: '0750' }
|
|
- { path: download, mode: '0750' }
|
|
|
|
- name: Copy IDP binary
|
|
ansible.builtin.copy:
|
|
src: ../oidc_idp/cacert-idp
|
|
dest: "{{ cacert_home }}/bin/cacert-idp"
|
|
owner: root
|
|
group: "{{ cacert_os_group }}"
|
|
mode: "0750"
|
|
|
|
- name: Check whether certificate exists
|
|
ansible.builtin.stat:
|
|
path: "{{ idp_tls.cert }}"
|
|
register: idp_cert_st
|
|
|
|
- name: Create IDP key and certificate with mkcert
|
|
block:
|
|
|
|
- name: Create temporary directory for IDP key and certificate
|
|
ansible.builtin.tempfile:
|
|
prefix: "idp-cert."
|
|
state: directory
|
|
register: idp_cert_temp_dir
|
|
|
|
- name: Create IDP key and certificate
|
|
ansible.builtin.command:
|
|
cmd: "/home/{{ ansible_user | default(ansible_env.USER) }}/.local/bin/mkcert -cert-file {{ idp_cert_temp_dir.path }}/idp.pem -key-file {{ idp_cert_temp_dir.path }}/idp.key.pem {{ oidc_urls.idp.host }}"
|
|
|
|
- name: Move IDP certificate and key to target
|
|
ansible.builtin.copy:
|
|
src: "{{ idp_cert_temp_dir.path }}/{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
owner: root
|
|
group: "{{ cacert_os_group }}"
|
|
mode: "{{ item.mode }}"
|
|
remote_src: true
|
|
loop:
|
|
- {src: idp.pem, dest: "{{ idp_tls.cert }}", mode: '0644'}
|
|
- {src: idp.key.pem, dest: "{{ idp_tls.key }}", mode: '0640'}
|
|
become: true
|
|
|
|
- name: Remove temporary directory
|
|
ansible.builtin.file:
|
|
path: "{{ idp_cert_temp_dir.path }}"
|
|
state: absent
|
|
|
|
when: use_mkcert and not idp_cert_st.stat.exists
|
|
become: false
|
|
|
|
- name: Copy IDP key and certificate from inventory
|
|
block:
|
|
|
|
- name: Copy IDP certificate
|
|
ansible.builtin.copy:
|
|
dest: "{{ idp_tls.cert }}"
|
|
owner: root
|
|
group: "{{ cacert_os_group }}"
|
|
mode: '0644'
|
|
content: "{{ idp_tls.certdata }}"
|
|
|
|
- name: Copy IDP key
|
|
ansible.builtin.copy:
|
|
dest: "{{ idp_tls.key }}"
|
|
owner: root
|
|
group: "{{ cacert_os_group }}"
|
|
mode: '0640'
|
|
content: "{{ idp_tls.keydata }}"
|
|
|
|
when: not use_mkcert
|
|
- name: Create IDP configuration
|
|
ansible.builtin.template:
|
|
src: idp_config.toml.j2
|
|
dest: "{{ cacert_home }}/etc/cacert-idp.toml"
|
|
owner: root
|
|
group: "{{ cacert_os_group }}"
|
|
mode: '0640'
|
|
notify: idp_systemd_reload
|
|
|
|
- name: Create IDP systemd unit file
|
|
ansible.builtin.template:
|
|
src: cacert-idp.service.j2
|
|
dest: /etc/systemd/system/cacert-idp.service
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
notify: idp_systemd_reload
|