rolle websites umgebaut

This reverts commit 60a946d54d.

defaults/main.yml

@@ -5,3 +5,4 @@ keycloak_postgresql_password: keycloak
 keycloak_initial_admin_name: keycloak
 keycloak_initial_admin_password: keycloak
 keycloak_http_host: 127.0.0.1
+keycloak_version: 26.2.4

tasks/main.yml

@@ -20,17 +20,7 @@
   include_role:
     name: website
   vars:
-    domainname: "{{ inventory_hostname }}"
+    websites: "{{ {inventory_hostname: {'proxy_pass': 'http://127.0.0.1:8080/'}} }}"
-    docroot: "/var/www/html"
-    optionalDirectives: |
-      ProxyPreserveHost On
-      SSLProxyEngine On
-      SSLProxyCheckPeerCN on
-      SSLProxyCheckPeerExpire on
-      RequestHeader set X-Forwarded-Proto "https"
-      RequestHeader set X-Forwarded-Port "443"
-      ProxyPass / http://127.0.0.1:8080/
-      ProxyPassReverse / http://127.0.0.1:8080/
 
 - name: create user for keycloak
   user:
@@ -43,53 +33,55 @@
 
 - name: check if keycloak-dir exists
   stat:
-    path: /opt/keycloak/keycloak-21.0.1
+    path: /opt/keycloak/keycloak-{{ keycloak_version }}
   register: keycloak_exists
 
-- name: Extract keycloak-21.0.1.zip to /opt/keycloak
+- name: Download keycloak-zip
+  ansible.builtin.get_url:
+    url: https://github.com/keycloak/keycloak/releases/download/{{ keycloak_version }}/keycloak-{{ keycloak_version }}.zip
+    dest: /opt/ansiblepackages/keycloak-{{ keycloak_version }}.zip
+    mode: '0400'
+
+- name: Extract keycloak-{{ keycloak_version }}.zip to /opt/keycloak
   unarchive:
-    src: keycloak-21.0.1.zip
+    src: /opt/ansiblepackages/keycloak-{{ keycloak_version }}.zip
     dest: /opt/keycloak
     owner: keycloak
     group: keycloak
+    remote_src: yes
   when: not keycloak_exists.stat.exists or redeploy is defined
 
-- name: link /opt/keycloak/keycloak-21.0.1 to /opt/keycloak/current
+- name: Create a directory if it does not exist
-  file:
-    state: link
-    owner: keycloak
-    group: keycloak
-    mode: '0770'
-    src: /opt/keycloak/keycloak-21.0.1
-    dest: /opt/keycloak/current
-
-##build once
-- name: check if /opt/keycloak/current/builtonce.txt exists
-  stat:
-    path: /opt/keycloak/current/builtonce.txt
-  register: builtonce_exists
-
-- name: build keycloak
-  command: sudo -u keycloak /opt/keycloak/current/bin/kc.sh build --db=postgres
-  when: not builtonce_exists.stat.exists
-
-- name: create file to track build
   ansible.builtin.file:
-    path: /opt/keycloak/current/builtonce.txt
+    path: /opt/keycloak/data
-    owner: keycloak
+    state: directory
-    group: keycloak
-    mode: '0770'
-    state: touch
-  when: not builtonce_exists.stat.exists
 
 - name: set permissions correct
   file:
     dest: /opt/keycloak
     owner: keycloak
     group: keycloak
-    mode: "0770"
+#    mode: "0770"
     recurse: yes
 
+- name: link /opt/keycloak-version to /opt/keycloak/current
+  file:
+    state: link
+    owner: keycloak
+    group: keycloak
+    mode: '0770'
+    src: /opt/keycloak/keycloak-{{ keycloak_version }}
+    dest: /opt/keycloak/current
+
+- name: link /opt/keycloak/data to /opt/keycloak/keycloak-version/data
+  file:
+    state: link
+    owner: keycloak
+    group: keycloak
+    mode: '0770'
+    src: /opt/keycloak/data
+    dest: /opt/keycloak/keycloak-{{ keycloak_version }}/data
+
 - name: generate /etc/systemd/system/keycloak.service
   template:
     src: keycloak.service.j2
@@ -99,6 +91,7 @@
     mode: "0644"
   notify:
     - reload systemd
+    - restart keycloak
 
 - name: Flush handlers
   meta: flush_handlers
@@ -111,82 +104,6 @@
   notify:
     restart keycloak
 
-- name: Flush handlers
-  meta: flush_handlers
-
-##add admin user once
-- name: check if /opt/keycloak/current/adminuseradded.txt exists
-  stat:
-    path: /opt/keycloak/current/adminuseradded.txt
-  register: adminuseradded_exists
-
-- name: stop keycloak
-  ansible.builtin.service:
-    name: keycloak
-    state: stopped
-  when: not adminuseradded_exists.stat.exists
-
-- name: generate /etc/systemd/system/keycloak.service
-  template:
-    src: keycloak.service_init.j2
-    dest: /etc/systemd/system/keycloak.service
-    owner: root
-    group: root
-    mode: "0644"
-  when: not adminuseradded_exists.stat.exists
-  notify:
-    - reload systemd
-
-- name: Flush handlers
-  meta: flush_handlers
-
-- name: start keycloak
-  ansible.builtin.service:
-    name: keycloak
-    state: started
-  when: not adminuseradded_exists.stat.exists
-
-- name: Sleep 120 seconds
-  ansible.builtin.wait_for:
-    timeout: 120
-  delegate_to: localhost
-  when: not adminuseradded_exists.stat.exists
-
-- name: stop keycloak
-  ansible.builtin.service:
-    name: keycloak
-    state: stopped
-  when: not adminuseradded_exists.stat.exists
-
-- name: generate /etc/systemd/system/keycloak.service
-  template:
-    src: keycloak.service.j2
-    dest: /etc/systemd/system/keycloak.service
-    owner: root
-    group: root
-    mode: "0644"
-  when: not adminuseradded_exists.stat.exists
-  notify:
-    - reload systemd
-
-- name: Flush handlers
-  meta: flush_handlers
-
-- name: start keycloak
-  ansible.builtin.service:
-    name: keycloak
-    state: started
-  when: not adminuseradded_exists.stat.exists
-
-- name: create file to track user creation
-  ansible.builtin.file:
-    path: /opt/keycloak/current/adminuseradded.txt
-    owner: keycloak
-    group: keycloak
-    mode: '0770'
-    state: touch
-  when: not adminuseradded_exists.stat.exists
-
 - name: start keycloak
   ansible.builtin.service:
     name: keycloak

templates/keycloak.service.j2

@@ -1,22 +1,45 @@
 [Unit]
-Description=Keycloak
+Description=Keycloak server
-After=network.target
+After=network-online.target
+Wants=network-online.target systemd-networkd-wait-online.service
 
 [Service]
-Type=idle
 User=keycloak
 Group=keycloak
 ExecStart=/opt/keycloak/current/bin/kc.sh start
+WorkingDirectory=/opt/keycloak/current
+ReadWritePaths=/opt/keycloak/keycloak-{{ keycloak_version }}/conf
+ReadWritePaths=/opt/keycloak/keycloak-{{ keycloak_version }}/data
+ReadWritePaths=/opt/keycloak/keycloak-{{ keycloak_version }}/lib/quarkus
+SuccessExitStatus=0 143
 TimeoutStartSec=600
 TimeoutStopSec=600
 Environment="KC_HTTP_HOST={{ keycloak_http_host }}"
+Environment="KC_HTTP_ENABLED=true"
 Environment="KC_HOSTNAME={{ inventory_hostname }}"
 Environment="KC_DB=postgres"
 Environment="KC_DB_USERNAME={{ keycloak_postgresql_username }}"
 Environment="KC_DB_PASSWORD={{ keycloak_postgresql_password }}"
 Environment="KC_DB_URL_DATABASE={{ keycloak_postgresql_database }}"
 Environment="KC_DB_URL_HOST=localhost"
+Environment="KEYCLOAK_ADMIN={{ keycloak_initial_admin_name }}"
+Environment="KEYCLOAK_ADMIN_PASSWORD={{ keycloak_initial_admin_password }}"
 Environment="KC_PROXY=edge"
+Environment="KC_PROXY_HEADERS=xforwarded"
+Environment="KC_PROXY_TRUSTED_ADDRESSES=127.0.0.1"
+
+# Hardening options
+CapabilityBoundingSet=
+AmbientCapabilities=
+NoNewPrivileges=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+PrivateTmp=true
+PrivateDevices=true
+LockPersonality=true
 
 [Install]
 WantedBy=multi-user.target

templates/keycloak.service_init.j2

@@ -1,24 +0,0 @@
-[Unit]
-Description=Keycloak
-After=network.target
-
-[Service]
-Type=idle
-User=keycloak
-Group=keycloak
-ExecStart=/opt/keycloak/current/bin/kc.sh start
-TimeoutStartSec=600
-TimeoutStopSec=600
-Environment="KC_HTTP_HOST={{ keycloak_http_host}}"
-Environment="KC_HOSTNAME={{ inventory_hostname }}"
-Environment="KC_DB=postgres"
-Environment="KC_DB_USERNAME={{ keycloak_postgresql_username }}"
-Environment="KC_DB_PASSWORD={{ keycloak_postgresql_password }}"
-Environment="KC_DB_URL_DATABASE={{ keycloak_postgresql_database }}"
-Environment="KC_DB_URL_HOST=localhost"
-Environment="KC_PROXY=edge"
-Environment="KEYCLOAK_ADMIN={{ keycloak_initial_admin_name }}"
-Environment="KEYCLOAK_ADMIN_PASSWORD={{ keycloak_initial_admin_password }}"
-
-[Install]
-WantedBy=multi-user.target