files/.gitignore

@@ -0,0 +1 @@
+*.deb

handlers/main.yml

@@ -1,9 +1,9 @@
 ---
+- name: reload systemd
+  sudo: yes
+  command: systemctl daemon-reload
+
 - name: restart step-ca
   service: 
     name: step-ca
     state: restarted
-
-- name: reload systemd
-  command: systemctl daemon-reload
-

tasks/main.yml

@@ -1,52 +1,22 @@
 ---
-- name: set package-names for armv7l
+- name: Copy Package to host
-  set_fact:
-    step: step_linux_0.15.16_armv7.tar.gz
-    stepca: step-ca_linux_0.15.15_armv7.tar.gz
-  when: 'ansible_architecture == "armv7l"'
-
-- name: set package-names for amd64
-  set_fact:
-    step: step_linux_0.15.16_amd64.tar.gz
-    stepca: step-ca_linux_0.15.15_amd64.tar.gz
-  when: ansible_architecture == "amd64"
-
-- name: stop when facts not set to download Packages
-  meta: end_play
-  when: step is not defined or stepca is not defined
-
-- name: Download Packages
-  get_url:
-    url: "{{ item }}"
-    dest: /opt/ansiblepackages
-    owner: root
-    group: root
-    mode: '0440'
-  with_items:
-    - "https://github.com/smallstep/certificates/releases/download/v0.15.15/{{ stepca }}"
-    - "https://github.com/smallstep/cli/releases/download/v0.15.16/{{ step }}"
-
-- name: extract Packages
-  unarchive:
-    src: "/opt/ansiblepackages/{{ item }}"
-    dest: /opt/ansiblepackages
-    remote_src: yes
-  with_items:
-    - "{{ step }}"
-    - "{{ stepca }}"
-
-- name: copy binaries
   copy:
-    src: "{{ item.src }}"
+    src: files/{{ item }}
-    dest: "{{ item.dst }}"
+    dest: "/opt/ansiblepackages/{{ item }}"
     owner: root
     group: root
-    mode: '0755'
+    mode: '0600'
-    backup: no
+    backup: yes
-    remote_src: yes
   with_items:
-    - { src: "/opt/ansiblepackages/step_0.15.16/bin/step", dst: "/usr/bin/step" }
+    - step-cli_0.15.16_amd64.deb
-    - { src: "/opt/ansiblepackages/step-ca_0.15.15/bin/step-ca", dst: "/usr/bin/step-ca" }
+    - step-ca_0.15.15_amd64.deb
+
+- name: install package
+  apt:
+    deb: "/opt/ansiblepackages/{{ item }}"
+  with_items:
+    - step-cli_0.15.16_amd64.deb
+    - step-ca_0.15.15_amd64.deb
 
 - name: create user for step-ca
   user:
@@ -65,10 +35,24 @@
     group: step
     mode: "0770"
 
+- name: link .step to /etc/step-ca
+  file:
+    state: link
+    src: /etc/step-ca
+    dest: ~/.step
+
 - name: init step-ca
-  command: sudo -u step step ca init -ssh --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
+  command: step ca init --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
   args:
-    creates: /etc/step-ca/.step/config
+    creates: /etc/step-ca/config
+
+- name: create /etc/step-ca/db
+  file:
+    state: directory
+    path: /etc/step-ca/db
+    owner: step
+    group: step
+    mode: "0770"
 
 - name: set permissions correct
   file:
@@ -78,6 +62,15 @@
     mode: "0770"
     recurse: yes
 
+- name: correct paths
+  replace:
+    path: "{{ item }}"
+    regexp: '\/root\/.step'
+    replace: "\/etc\/step-ca"
+  with_items:
+  - /etc/step-ca/config/ca.json
+  - /etc/step-ca/config/defaults.json
+
 - name: generate /etc/systemd/system/step-ca.service
   template:
     src: step-ca.service.j2
@@ -88,24 +81,6 @@
   notify:
     - reload systemd
 
-- name: correct ca.json step 1
-  lineinfile:
-    path: /etc/step-ca/.step/config/ca.json
-    line: "{{'\t'}}{{'\t'}}\"type\": \"badgerV2\","
-    state: present
-    regexp: "^{{'\t'}}{{'\t'}}\"type\": \"badger"
-  notify:
-    - restart step-ca
-
-- name: correct ca.json step 2
-  lineinfile:
-    path: /etc/step-ca/.step/config/ca.json
-    line: "{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\": \"FileIO\""
-    state: present
-    regexp: "^{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\":"
-  notify:
-    - restart step-ca
-
 - name: Flush handlers
   meta: flush_handlers
 
@@ -120,32 +95,18 @@
 - name: Flush handlers
   meta: flush_handlers
 
-- name: check for acme privisioner
+- name: list provisioners
-  lineinfile:
+  command: step ca provisioner list
-    path: /etc/step-ca/.step/config/ca.json
+  register: povisionerlist
-    regexp: '.*"type": "ACME",.*'
-    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"ACME\","
-    state: present
-  check_mode: yes
-  register: acmepresent
 
 - name: add acme provisioner
-  command: sudo -u step step ca provisioner add acme --type ACME
+  command: step ca provisioner add acme --type ACME
-  when: acmepresent is changed
+  when: not povisionerlist.stdout.find ("ACME") != -1
   notify:
     - restart step-ca
 
-- name: check for default JWK privisioner
-  lineinfile:
-    path: /etc/step-ca/.step/config/ca.json
-    regexp: '.*"type": "JWK",.*'
-    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"JWK\","
-    state: absent
-  check_mode: yes
-  register: jwkabsent
-
 - name: remove jwk provisioner
-  command: sudo -u step step ca provisioner remove "{{ pki_name }}" --type JWK
+  command: step ca provisioner remove "{{ pki_name }}" --type JWK
-  when: jwkabsent is changed
+  when: povisionerlist.stdout.find ("JWK") != -1
   notify:
     - restart step-ca

templates/step-ca.service.j2

@@ -6,16 +6,16 @@ After=network-online.target
 Wants=network-online.target
 StartLimitIntervalSec=30
 StartLimitBurst=3
-ConditionFileNotEmpty=/etc/step-ca/.step/config/ca.json
+ConditionFileNotEmpty=/etc/step-ca/config/ca.json
 ConditionFileNotEmpty=/etc/step-ca/password.txt
 
 [Service]
 Type=simple
 User=step
 Group=step
-Environment=STEPPATH=/etc/step-ca/.step
+Environment=STEPPATH=/etc/step-ca
-WorkingDirectory=/etc/step-ca/.step
+WorkingDirectory=/etc/step-ca
-ExecStart=/usr/bin/step-ca config/ca.json --password-file ../password.txt
+ExecStart=/usr/bin/step-ca config/ca.json --password-file password.txt
 ExecReload=/bin/kill --signal HUP $MAINPID
 Restart=on-failure
 RestartSec=5
@@ -23,5 +23,32 @@ TimeoutStopSec=30
 StartLimitInterval=30
 StartLimitBurst=3
 
+; Process capabilities & privileges
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+SecureBits=keep-caps
+NoNewPrivileges=yes
+
+; Sandboxing
+ProtectSystem=full
+ProtectHome=true
+RestrictNamespaces=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+PrivateTmp=true
+PrivateDevices=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectKernelTunables=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+RestrictRealtime=true
+SystemCallFilter=@system-service
+SystemCallArchitectures=native
+MemoryDenyWriteExecute=true
+ReadWriteDirectories=/etc/step-ca/db
+
 [Install]
 WantedBy=multi-user.target