updated stepca

This reverts commit 62df127cfb.

files/.gitignore

@@ -1 +0,0 @@
-*.deb

handlers/main.yml

@@ -1,9 +1,9 @@
 ---
-- name: reload systemd
-  sudo: yes
-  command: systemctl daemon-reload
-
 - name: restart step-ca
   service: 
     name: step-ca
     state: restarted
+
+- name: reload systemd
+  command: systemctl daemon-reload
+

tasks/main.yml

@@ -1,22 +1,31 @@
 ---
-- name: Copy Package to host
+- name: show ansible_architecture
-  copy:
+  ansible.builtin.debug:
-    src: files/{{ item }}
+    var: ansible_architecture
-    dest: "/opt/ansiblepackages/{{ item }}"
-    owner: root
-    group: root
-    mode: '0600'
-    backup: yes
-  with_items:
-    - step-cli_0.15.16_amd64.deb
-    - step-ca_0.15.15_amd64.deb
 
-- name: install package
+- name: set package-names for aarch64
+  set_fact:
+    step: https://github.com/smallstep/cli/releases/download/v0.24.2-rc.6/step-cli_0.24.2-rc.6_arm64.deb
+    stepca: https://github.com/smallstep/certificates/releases/download/v0.24.3-rc.2/step-ca_0.24.3-rc.2_arm64.deb
+  when: 'ansible_architecture == "aarch64"'
+
+- name: set package-names for amd64
+  set_fact:
+    step: https://dl.smallstep.com/cli/docs-ca-install/latest/step-cli_amd64.deb
+    stepca: https://dl.smallstep.com/certificates/docs-ca-install/latest/step-ca_amd64.deb
+  when: ansible_architecture == "amd64" or ansible_architecture == "x86_64"
+
+- name: stop when facts not set to download Packages
+  meta: end_play
+  when: step is not defined or stepca is not defined
+
+- name: Install step-cli
   apt:
-    deb: "/opt/ansiblepackages/{{ item }}"
+    deb: "{{ step }}"
-  with_items:
+
-    - step-cli_0.15.16_amd64.deb
+- name: Install step-ca
-    - step-ca_0.15.15_amd64.deb
+  apt:
+    deb: "{{ stepca }}"
 
 - name: create user for step-ca
   user:
@@ -35,24 +44,10 @@
     group: step
     mode: "0770"
 
-- name: link .step to /etc/step-ca
-  file:
-    state: link
-    src: /etc/step-ca
-    dest: ~/.step
-
 - name: init step-ca
-  command: step ca init --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
+  command: sudo -u step step ca init --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
   args:
-    creates: /etc/step-ca/config
+    creates: /etc/step-ca/.step/config
-
-- name: create /etc/step-ca/db
-  file:
-    state: directory
-    path: /etc/step-ca/db
-    owner: step
-    group: step
-    mode: "0770"
 
 - name: set permissions correct
   file:
@@ -62,15 +57,6 @@
     mode: "0770"
     recurse: yes
 
-- name: correct paths
-  replace:
-    path: "{{ item }}"
-    regexp: '\/root\/.step'
-    replace: "\/etc\/step-ca"
-  with_items:
-  - /etc/step-ca/config/ca.json
-  - /etc/step-ca/config/defaults.json
-
 - name: generate /etc/systemd/system/step-ca.service
   template:
     src: step-ca.service.j2
@@ -81,6 +67,24 @@
   notify:
     - reload systemd
 
+#- name: correct ca.json step 1
+#  lineinfile:
+#    path: /etc/step-ca/.step/config/ca.json
+#    line: "{{'\t'}}{{'\t'}}\"type\": \"badgerV2\","
+#    state: present
+#    regexp: "^{{'\t'}}{{'\t'}}\"type\": \"badger"
+#  notify:
+#    - restart step-ca
+
+#- name: correct ca.json step 2
+#  lineinfile:
+#    path: /etc/step-ca/.step/config/ca.json
+#    line: "{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\": \"FileIO\""
+#    state: present
+#    regexp: "^{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\":"
+#  notify:
+#    - restart step-ca
+
 - name: Flush handlers
   meta: flush_handlers
 
@@ -95,18 +99,32 @@
 - name: Flush handlers
   meta: flush_handlers
 
-- name: list provisioners
+- name: check for acme privisioner
-  command: step ca provisioner list
+  lineinfile:
-  register: povisionerlist
+    path: /etc/step-ca/.step/config/ca.json
+    regexp: '.*"type": "ACME",.*'
+    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"ACME\","
+    state: present
+  check_mode: yes
+  register: acmepresent
 
 - name: add acme provisioner
-  command: step ca provisioner add acme --type ACME
+  command: sudo -u step step ca provisioner add acme --type ACME
-  when: not povisionerlist.stdout.find ("ACME") != -1
+  when: acmepresent is changed
   notify:
     - restart step-ca
 
+- name: check for default JWK privisioner
+  lineinfile:
+    path: /etc/step-ca/.step/config/ca.json
+    regexp: '.*"type": "JWK",.*'
+    line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"JWK\","
+    state: absent
+  check_mode: yes
+  register: jwkabsent
+
 - name: remove jwk provisioner
-  command: step ca provisioner remove "{{ pki_name }}" --type JWK
+  command: sudo -u step step ca provisioner remove "{{ pki_name }}"
-  when: povisionerlist.stdout.find ("JWK") != -1
+  when: jwkabsent is changed
   notify:
-    - restart step-ca
+    - restart step-ca

templates/step-ca.service.j2

@@ -6,16 +6,16 @@ After=network-online.target
 Wants=network-online.target
 StartLimitIntervalSec=30
 StartLimitBurst=3
-ConditionFileNotEmpty=/etc/step-ca/config/ca.json
+ConditionFileNotEmpty=/etc/step-ca/.step/config/ca.json
 ConditionFileNotEmpty=/etc/step-ca/password.txt
 
 [Service]
 Type=simple
 User=step
 Group=step
-Environment=STEPPATH=/etc/step-ca
+Environment=STEPPATH=/etc/step-ca/.step
-WorkingDirectory=/etc/step-ca
+WorkingDirectory=/etc/step-ca/.step
-ExecStart=/usr/bin/step-ca config/ca.json --password-file password.txt
+ExecStart=/usr/bin/step-ca config/ca.json --password-file ../password.txt
 ExecReload=/bin/kill --signal HUP $MAINPID
 Restart=on-failure
 RestartSec=5
@@ -23,32 +23,5 @@ TimeoutStopSec=30
 StartLimitInterval=30
 StartLimitBurst=3
 
-; Process capabilities & privileges
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-SecureBits=keep-caps
-NoNewPrivileges=yes
-
-; Sandboxing
-ProtectSystem=full
-ProtectHome=true
-RestrictNamespaces=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-PrivateTmp=true
-PrivateDevices=true
-ProtectClock=true
-ProtectControlGroups=true
-ProtectKernelTunables=true
-ProtectKernelLogs=true
-ProtectKernelModules=true
-LockPersonality=true
-RestrictSUIDSGID=true
-RemoveIPC=true
-RestrictRealtime=true
-SystemCallFilter=@system-service
-SystemCallArchitectures=native
-MemoryDenyWriteExecute=true
-ReadWriteDirectories=/etc/step-ca/db
-
 [Install]
 WantedBy=multi-user.target