changed trigger

files/.gitignore

@@ -1 +0,0 @@
-*.deb

handlers/main.yml

@@ -1,9 +1,9 @@
 ---
-- name: reload systemd
-  sudo: yes
-  command: systemctl daemon-reload
-
 - name: restart step-ca
   service: 
     name: step-ca
     state: restarted
+
+- name: reload systemd
+  command: systemctl daemon-reload
+

tasks/main.yml

@@ -1,22 +1,52 @@
 ---
-- name: Copy Package to host
+- name: set package-names for armv7l
-  copy:
+  set_fact:
-    src: files/{{ item }}
+    step: step_linux_0.15.16_armv7.tar.gz
-    dest: "/opt/ansiblepackages/{{ item }}"
+    stepca: step-ca_linux_0.15.15_armv7.tar.gz
+  when: 'ansible_architecture == "armv7l"'
+
+- name: set package-names for amd64
+  set_fact:
+    step: step_linux_0.15.16_amd64.tar.gz
+    stepca: step-ca_linux_0.15.15_amd64.tar.gz
+  when: ansible_architecture == "amd64"
+
+- name: stop when facts not set to download Packages
+  meta: end_play
+  when: step is not defined or stepca is not defined
+
+- name: Download Packages
+  get_url:
+    url: "{{ item }}"
+    dest: /opt/ansiblepackages
     owner: root
     group: root
-    mode: '0600'
+    mode: '0440'
-    backup: yes
   with_items:
-    - step-cli_0.15.16_amd64.deb
+    - "https://github.com/smallstep/certificates/releases/download/v0.15.15/{{ stepca }}"
-    - step-ca_0.15.15_amd64.deb
+    - "https://github.com/smallstep/cli/releases/download/v0.15.16/{{ step }}"
 
-- name: install package
+- name: extract Packages
-  apt:
+  unarchive:
-    deb: "/opt/ansiblepackages/{{ item }}"
+    src: "/opt/ansiblepackages/{{ item }}"
+    dest: /opt/ansiblepackages
+    remote_src: yes
   with_items:
-    - step-cli_0.15.16_amd64.deb
+    - "{{ step }}"
-    - step-ca_0.15.15_amd64.deb
+    - "{{ stepca }}"
+
+- name: copy binaries
+  copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dst }}"
+    owner: root
+    group: root
+    mode: '0755'
+    backup: no
+    remote_src: yes
+  with_items:
+    - { src: "/opt/ansiblepackages/step_0.15.16/bin/step", dst: "/usr/bin/step" }
+    - { src: "/opt/ansiblepackages/step-ca_0.15.15/bin/step-ca", dst: "/usr/bin/step-ca" }
 
 - name: create user for step-ca
   user:
@@ -35,24 +65,10 @@
     group: step
     mode: "0770"
 
-- name: link .step to /etc/step-ca
-  file:
-    state: link
-    src: /etc/step-ca
-    dest: ~/.step
-
 - name: init step-ca
-  command: step ca init --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
+  command: sudo -u step step ca init -ssh --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
   args:
-    creates: /etc/step-ca/config
+    creates: /etc/step-ca/.step/config
-
-- name: create /etc/step-ca/db
-  file:
-    state: directory
-    path: /etc/step-ca/db
-    owner: step
-    group: step
-    mode: "0770"
 
 - name: set permissions correct
   file:
@@ -62,15 +78,6 @@
     mode: "0770"
     recurse: yes
 
-- name: correct paths
-  replace:
-    path: "{{ item }}"
-    regexp: '\/root\/.step'
-    replace: "\/etc\/step-ca"
-  with_items:
-  - /etc/step-ca/config/ca.json
-  - /etc/step-ca/config/defaults.json
-
 - name: generate /etc/systemd/system/step-ca.service
   template:
     src: step-ca.service.j2
@@ -81,6 +88,24 @@
   notify:
     - reload systemd
 
+- name: correct ca.json step 1
+  lineinfile:
+    path: /etc/step-ca/.step/config/ca.json
+    line: "{{'\t'}}{{'\t'}}\"type\": \"badgerV2\","
+    state: present
+    regexp: "^{{'\t'}}{{'\t'}}\"type\": \"badger"
+  notify:
+    - restart step-ca
+
+- name: correct ca.json step 2
+  lineinfile:
+    path: /etc/step-ca/.step/config/ca.json
+    line: "{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\": \"FileIO\""
+    state: present
+    regexp: "^{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\":"
+  notify:
+    - restart step-ca
+
 - name: Flush handlers
   meta: flush_handlers
 
@@ -95,18 +120,32 @@
 - name: Flush handlers
   meta: flush_handlers
 
-- name: list provisioners
+- name: check for acme privisioner
-  command: step ca provisioner list
+  lineinfile:
-  register: povisionerlist
+    path: /etc/step-ca/.step/config/ca.json
+    regexp: '.*"type": "ACME",.*'
+    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"ACME\","
+    state: present
+  check_mode: yes
+  register: acmepresent
 
 - name: add acme provisioner
-  command: step ca provisioner add acme --type ACME
+  command: sudo -u step step ca provisioner add acme --type ACME
-  when: not povisionerlist.stdout.find ("ACME") != -1
+  when: acmepresent is changed
   notify:
     - restart step-ca
 
+- name: check for default JWK privisioner
+  lineinfile:
+    path: /etc/step-ca/.step/config/ca.json
+    regexp: '.*"type": "JWK",.*'
+    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"JWK\","
+    state: absent
+  check_mode: yes
+  register: jwkabsent
+
 - name: remove jwk provisioner
-  command: step ca provisioner remove "{{ pki_name }}" --type JWK
+  command: sudo -u step step ca provisioner remove "{{ pki_name }}" --type JWK
-  when: povisionerlist.stdout.find ("JWK") != -1
+  when: jwkabsent is changed
   notify:
-    - restart step-ca
+    - restart step-ca

templates/step-ca.service.j2

@@ -6,16 +6,16 @@ After=network-online.target
 Wants=network-online.target
 StartLimitIntervalSec=30
 StartLimitBurst=3
-ConditionFileNotEmpty=/etc/step-ca/config/ca.json
+ConditionFileNotEmpty=/etc/step-ca/.step/config/ca.json
 ConditionFileNotEmpty=/etc/step-ca/password.txt
 
 [Service]
 Type=simple
 User=step
 Group=step
-Environment=STEPPATH=/etc/step-ca
+Environment=STEPPATH=/etc/step-ca/.step
-WorkingDirectory=/etc/step-ca
+WorkingDirectory=/etc/step-ca/.step
-ExecStart=/usr/bin/step-ca config/ca.json --password-file password.txt
+ExecStart=/usr/bin/step-ca config/ca.json --password-file ../password.txt
 ExecReload=/bin/kill --signal HUP $MAINPID
 Restart=on-failure
 RestartSec=5
@@ -23,32 +23,5 @@ TimeoutStopSec=30
 StartLimitInterval=30
 StartLimitBurst=3
 
-; Process capabilities & privileges
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-SecureBits=keep-caps
-NoNewPrivileges=yes
-
-; Sandboxing
-ProtectSystem=full
-ProtectHome=true
-RestrictNamespaces=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-PrivateTmp=true
-PrivateDevices=true
-ProtectClock=true
-ProtectControlGroups=true
-ProtectKernelTunables=true
-ProtectKernelLogs=true
-ProtectKernelModules=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RemoveIPC=true
-RestrictRealtime=true
-SystemCallFilter=@system-service
-SystemCallArchitectures=native
-MemoryDenyWriteExecute=true
-ReadWriteDirectories=/etc/step-ca/db
-
 [Install]
 WantedBy=multi-user.target