151 lines
3.8 KiB
YAML
151 lines
3.8 KiB
YAML
---
|
|
- name: set package-names for armv7l
|
|
set_fact:
|
|
step: step_linux_0.15.16_armv7.tar.gz
|
|
stepca: step-ca_linux_0.15.15_armv7.tar.gz
|
|
when: 'ansible_architecture == "armv7l"'
|
|
|
|
- name: set package-names for amd64
|
|
set_fact:
|
|
step: step_linux_0.15.16_amd64.tar.gz
|
|
stepca: step-ca_linux_0.15.15_amd64.tar.gz
|
|
when: ansible_architecture == "amd64"
|
|
|
|
- name: stop when facts not set to download Packages
|
|
meta: end_play
|
|
when: step is not defined or stepca is not defined
|
|
|
|
- name: Download Packages
|
|
get_url:
|
|
url: "{{ item }}"
|
|
dest: /opt/ansiblepackages
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
with_items:
|
|
- "https://github.com/smallstep/certificates/releases/download/v0.15.15/{{ stepca }}"
|
|
- "https://github.com/smallstep/cli/releases/download/v0.15.16/{{ step }}"
|
|
|
|
- name: extract Packages
|
|
unarchive:
|
|
src: "/opt/ansiblepackages/{{ item }}"
|
|
dest: /opt/ansiblepackages
|
|
remote_src: yes
|
|
with_items:
|
|
- "{{ step }}"
|
|
- "{{ stepca }}"
|
|
|
|
- name: copy binaries
|
|
copy:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dst }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
backup: no
|
|
remote_src: yes
|
|
with_items:
|
|
- { src: "/opt/ansiblepackages/step_0.15.16/bin/step", dst: "/usr/bin/step" }
|
|
- { src: "/opt/ansiblepackages/step-ca_0.15.15/bin/step-ca", dst: "/usr/bin/step-ca" }
|
|
|
|
- name: create user for step-ca
|
|
user:
|
|
name: step
|
|
state: present
|
|
shell: /bin/false
|
|
system: yes
|
|
createhome: yes
|
|
home: /etc/step-ca
|
|
|
|
- name: generate /etc/step-ca/password.txt
|
|
template:
|
|
src: password.txt.j2
|
|
dest: /etc/step-ca/password.txt
|
|
owner: step
|
|
group: step
|
|
mode: "0770"
|
|
|
|
- name: init step-ca
|
|
command: sudo -u step step ca init -ssh --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
|
|
args:
|
|
creates: /etc/step-ca/.step/config
|
|
|
|
- name: set permissions correct
|
|
file:
|
|
dest: /etc/step-ca
|
|
owner: step
|
|
group: step
|
|
mode: "0770"
|
|
recurse: yes
|
|
|
|
- name: generate /etc/systemd/system/step-ca.service
|
|
template:
|
|
src: step-ca.service.j2
|
|
dest: /etc/systemd/system/step-ca.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- reload systemd
|
|
|
|
- name: correct ca.json step 1
|
|
lineinfile:
|
|
path: /etc/step-ca/.step/config/ca.json
|
|
line: "{{'\t'}}{{'\t'}}\"type\": \"badgerV2\","
|
|
state: present
|
|
regexp: "^{{'\t'}}{{'\t'}}\"type\": \"badger"
|
|
notify:
|
|
- restart step-ca
|
|
|
|
- name: correct ca.json step 2
|
|
lineinfile:
|
|
path: /etc/step-ca/.step/config/ca.json
|
|
line: "{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\": \"FileIO\""
|
|
state: present
|
|
regexp: "^{{'\t'}}{{'\t'}}\"badgerFileLoadingMode\":"
|
|
notify:
|
|
- restart step-ca
|
|
|
|
- name: Flush handlers
|
|
meta: flush_handlers
|
|
|
|
- name: enable step-ca
|
|
systemd:
|
|
name: step-ca
|
|
enabled: yes
|
|
masked: no
|
|
notify:
|
|
restart step-ca
|
|
|
|
- name: Flush handlers
|
|
meta: flush_handlers
|
|
|
|
- name: check for acme privisioner
|
|
lineinfile:
|
|
path: /etc/step-ca/.step/config/ca.json
|
|
regexp: '.*"type": "ACME",.*'
|
|
line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"ACME\","
|
|
state: present
|
|
check_mode: yes
|
|
register: acmepresent
|
|
|
|
- name: add acme provisioner
|
|
command: sudo -u step step ca provisioner add acme --type ACME
|
|
when: acmepresent is changed
|
|
notify:
|
|
- restart step-ca
|
|
|
|
- name: check for default JWK privisioner
|
|
lineinfile:
|
|
path: /etc/step-ca/.step/config/ca.json
|
|
regexp: '.*"type": "JWK",.*'
|
|
line: "{{'\t'}}{{'\t'}}{{'\t'}}{{'\t'}}\"type\": \"JWK\","
|
|
state: absent
|
|
check_mode: yes
|
|
register: jwkabsent
|
|
|
|
- name: remove jwk provisioner
|
|
command: sudo -u step step ca provisioner remove "{{ pki_name }}" --type JWK
|
|
when: jwkabsent is changed
|
|
notify:
|
|
- restart step-ca |