update step-ca role

tasks/main.yml

@@ -45,8 +45,8 @@
     backup: no
     remote_src: yes
   with_items:
-    - { src: "/opt/ansiblepackages/step_0.15.16/bin/step", dst: "/bin/step" }
-    - { src: "/opt/ansiblepackages/step-ca_0.15.15/bin/step-ca", dst: "/bin/step-ca" }
+    - { src: "/opt/ansiblepackages/step_0.15.16/bin/step", dst: "/usr/bin/step" }
+    - { src: "/opt/ansiblepackages/step-ca_0.15.15/bin/step-ca", dst: "/usr/bin/step-ca" }
 
 - name: create user for step-ca
   user:
@@ -65,6 +65,11 @@
     group: step
     mode: "0770"
 
+- name: init step-ca
+  command: sudo -u step step ca init -ssh --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
+  args:
+    creates: /etc/step-ca/.step/config
+
 - name: set permissions correct
   file:
     dest: /etc/step-ca
@@ -73,20 +78,6 @@
     mode: "0770"
     recurse: yes
 
-- name: init step-ca
-  command: sudo -u step step ca init -ssh --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
-  args:
-    creates: /etc/step-ca/.step/config
-
-- name: correct badgerValueLogLoadingMode
-  lineinfile:
-    path: /etc/step-ca/.step/config/ca.json
-    line: "{{'\t'}}{{'\t'}},\"badgerValueLogLoadingMode\": \"FileIO\""
-    state: present
-    insertafter: "{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\": \"\""
-  notify:
-    - restart step-ca
-
 - name: generate /etc/systemd/system/step-ca.service
   template:
     src: step-ca.service.j2
@@ -97,6 +88,30 @@
   notify:
     - reload systemd
 
+- name: correct ca.json step 1
+  lineinfile:
+    path: /etc/step-ca/.step/config/ca.json
+    line: "{{'\t'}}{{'\t'}}\"type\": \"badgerV2\","
+    state: present
+    regexp: "^{{'\t'}}{{'\t'}}\"type\": \"badger\","
+  notify:
+    - restart step-ca
+
+- name: correct ca.json step 2
+  lineinfile:
+    path: /etc/step-ca/.step/config/ca.json
+    line: "{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\": \"FileIO\""
+    state: present
+    regexp: "^{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\":"
+  notify:
+    - restart step-ca
+
+#    "db": {
+#      "type": "badgerV2",
+#      "dataSource": "/etc/step-ca/.step/db",
+#      "badgerFileLoadingMode": "FileIO"
+#   },
+
 - name: Flush handlers
   meta: flush_handlers
 

templates/step-ca.service.j2

@@ -30,19 +30,13 @@ SecureBits=keep-caps
 NoNewPrivileges=yes
 
 ; Sandboxing
-ProtectSystem=full
-ProtectHome=true
-RestrictNamespaces=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 PrivateTmp=true
 PrivateDevices=true
-ProtectClock=true
 ProtectControlGroups=true
 ProtectKernelTunables=true
-ProtectKernelLogs=true
 ProtectKernelModules=true
 LockPersonality=true
-RestrictSUIDSGID=true
 RemoveIPC=true
 RestrictRealtime=true
 SystemCallFilter=@system-service