ansible-role-step-ca/tasks/main.yml

---
- name: set package-names for armv7l
  set_fact:
    step: step_linux_0.15.16_armv7.tar.gz
    stepca: step-ca_linux_0.15.15_armv7.tar.gz
  when: 'ansible_architecture == "armv7l"'

- name: set package-names for amd64
  set_fact:
    step: step_linux_0.15.16_amd64.tar.gz
    stepca: step-ca_linux_0.15.15_amd64.tar.gz
  when: ansible_architecture == "amd64"

- name: stop when facts not set to download Packages
  meta: end_play
  when: step is not defined or stepca is not defined

- name: Download Packages
  get_url:
    url: "{{ item }}"
    dest: /opt/ansiblepackages
    owner: root
    group: root
    mode: '0440'
  with_items:
    - "https://github.com/smallstep/certificates/releases/download/v0.15.15/{{ stepca }}"
    - "https://github.com/smallstep/cli/releases/download/v0.15.16/{{ step }}"

- name: extract Packages
  unarchive:
    src: "/opt/ansiblepackages/{{ item }}"
    dest: /opt/ansiblepackages
    remote_src: yes
  with_items:
    - "{{ step }}"
    - "{{ stepca }}"

- name: copy binaries
  copy:
    src: "{{ item.src }}"
    dest: "{{ item.dst }}"
    owner: root
    group: root
    mode: '0755'
    backup: no
    remote_src: yes
  with_items:
    - { src: "/opt/ansiblepackages/step_0.15.16/bin/step", dst: "/usr/bin/step" }
    - { src: "/opt/ansiblepackages/step-ca_0.15.15/bin/step-ca", dst: "/usr/bin/step-ca" }

- name: create user for step-ca
  user:
    name: step
    state: present
    shell: /bin/false
    system: yes
    createhome: yes
    home: /etc/step-ca

- name: generate /etc/step-ca/password.txt
  template:
    src: password.txt.j2
    dest: /etc/step-ca/password.txt
    owner: step
    group: step
    mode: "0770"

- name: init step-ca
  command: sudo -u step step ca init -ssh --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
  args:
    creates: /etc/step-ca/.step/config

- name: set permissions correct
  file:
    dest: /etc/step-ca
    owner: step
    group: step
    mode: "0770"
    recurse: yes

- name: generate /etc/systemd/system/step-ca.service
  template:
    src: step-ca.service.j2
    dest: /etc/systemd/system/step-ca.service
    owner: root
    group: root
    mode: "0644"
  notify:
    - reload systemd

- name: correct ca.json step 1
  lineinfile:
    path: /etc/step-ca/.step/config/ca.json
    line: "{{'\t'}}{{'\t'}}\"type\": \"badgerV2\","
    state: present
    regexp: "^{{'\t'}}{{'\t'}}\"type\": \"badger\","
  notify:
    - restart step-ca

- name: correct ca.json step 2
  lineinfile:
    path: /etc/step-ca/.step/config/ca.json
    line: "{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\": \"FileIO\""
    state: present
    regexp: "^{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\":"
  notify:
    - restart step-ca

- name: Flush handlers
  meta: flush_handlers

- name: enable step-ca
  systemd:
    name: step-ca
    enabled: yes
    masked: no
  notify:
    restart step-ca

- name: Flush handlers
  meta: flush_handlers

- name: check for acme privisioner
  lineinfile:
    path: /etc/step-ca/.step/config/ca.json
    regexp: '.*"type": "ACME",.*'
    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"ACME\","
    state: present
  check_mode: yes
  register: acmepresent

- name: add acme provisioner
  command: sudo -u step step ca provisioner add acme --type ACME
  when: acmepresent is changed
  notify:
    - restart step-ca

- name: check for default JWK privisioner
  lineinfile:
    path: /etc/step-ca/.step/config/ca.json
    regexp: '.*"type": "JWK",.*'
    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"JWK\","
    state: absent
  check_mode: yes
  register: jwkabsent

- name: remove jwk provisioner
  command: sudo -u step step ca provisioner remove "{{ pki_name }}" --type JWK
  when: jwkabsent is changed
  notify:
    - restart step-ca