2021-05-30 01:00:24 +02:00
|
|
|
---
|
|
|
|
- name: Copy Package to host
|
|
|
|
copy:
|
|
|
|
src: files/{{ item }}
|
|
|
|
dest: "/opt/ansiblepackages/{{ item }}"
|
|
|
|
owner: root
|
|
|
|
group: root
|
|
|
|
mode: '0600'
|
|
|
|
backup: yes
|
|
|
|
with_items:
|
|
|
|
- step-cli_0.15.16_amd64.deb
|
|
|
|
- step-ca_0.15.15_amd64.deb
|
|
|
|
|
|
|
|
- name: install package
|
|
|
|
apt:
|
|
|
|
deb: "/opt/ansiblepackages/{{ item }}"
|
|
|
|
with_items:
|
|
|
|
- step-cli_0.15.16_amd64.deb
|
|
|
|
- step-ca_0.15.15_amd64.deb
|
|
|
|
|
|
|
|
- name: create user for step-ca
|
|
|
|
user:
|
|
|
|
name: step
|
|
|
|
state: present
|
|
|
|
shell: /bin/false
|
|
|
|
system: yes
|
|
|
|
createhome: yes
|
|
|
|
home: /etc/step-ca
|
|
|
|
|
|
|
|
- name: generate /etc/step-ca/password.txt
|
|
|
|
template:
|
|
|
|
src: password.txt.j2
|
|
|
|
dest: /etc/step-ca/password.txt
|
|
|
|
owner: step
|
|
|
|
group: step
|
2021-05-30 19:43:31 +02:00
|
|
|
mode: "0770"
|
2021-05-30 01:00:24 +02:00
|
|
|
|
|
|
|
- name: link .step to /etc/step-ca
|
|
|
|
file:
|
|
|
|
state: link
|
|
|
|
src: /etc/step-ca
|
|
|
|
dest: ~/.step
|
|
|
|
|
|
|
|
- name: init step-ca
|
2021-05-30 19:43:31 +02:00
|
|
|
command: step ca init --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
|
2021-05-30 01:00:24 +02:00
|
|
|
args:
|
|
|
|
creates: /etc/step-ca/config
|
|
|
|
|
|
|
|
- name: create /etc/step-ca/db
|
|
|
|
file:
|
|
|
|
state: directory
|
|
|
|
path: /etc/step-ca/db
|
|
|
|
owner: step
|
|
|
|
group: step
|
|
|
|
mode: "0770"
|
|
|
|
|
|
|
|
- name: set permissions correct
|
|
|
|
file:
|
|
|
|
dest: /etc/step-ca
|
|
|
|
owner: step
|
|
|
|
group: step
|
|
|
|
mode: "0770"
|
|
|
|
recurse: yes
|
|
|
|
|
|
|
|
- name: correct paths
|
|
|
|
replace:
|
|
|
|
path: "{{ item }}"
|
|
|
|
regexp: '\/root\/.step'
|
|
|
|
replace: "\/etc\/step-ca"
|
|
|
|
with_items:
|
|
|
|
- /etc/step-ca/config/ca.json
|
|
|
|
- /etc/step-ca/config/defaults.json
|
|
|
|
|
|
|
|
- name: generate /etc/systemd/system/step-ca.service
|
|
|
|
template:
|
|
|
|
src: step-ca.service.j2
|
|
|
|
dest: /etc/systemd/system/step-ca.service
|
|
|
|
owner: root
|
|
|
|
group: root
|
|
|
|
mode: "0644"
|
|
|
|
notify:
|
|
|
|
- reload systemd
|
|
|
|
|
2021-05-30 19:43:31 +02:00
|
|
|
- name: Flush handlers
|
|
|
|
meta: flush_handlers
|
|
|
|
|
2021-05-30 01:00:24 +02:00
|
|
|
- name: enable step-ca
|
|
|
|
systemd:
|
|
|
|
name: step-ca
|
|
|
|
enabled: yes
|
2021-05-30 19:43:31 +02:00
|
|
|
masked: no
|
|
|
|
|
|
|
|
- name: list provisioners
|
|
|
|
command: step ca provisioner list
|
|
|
|
register: povisionerlist
|
|
|
|
|
|
|
|
- name: add acme provisioner
|
|
|
|
command: step ca provisioner add acme --type ACME
|
|
|
|
when: not povisionerlist.stdout.find ("ACME") != -1
|
|
|
|
notify:
|
|
|
|
- restart step-ca
|
|
|
|
|
|
|
|
- name: remove jwk provisioner
|
|
|
|
command: step ca provisioner remove "{{ pki_name }}" --type JWK
|
|
|
|
when: povisionerlist.stdout.find ("JWK") != -1
|
|
|
|
notify:
|
|
|
|
- restart step-ca
|