Update to 2024-09-26 12:00

roles/nomad/tasks/conf.yml

@@ -26,13 +26,31 @@
         cert_path: "{{ nomad_conf.consul.cert_file }}"
         cert_key_path: "{{ nomad_conf.consul.key_file }}"
         cert_key_mode: omit
-      tags: nomad
 
     - name: Check if CA exists
       stat: path={{ nomad_conf.tls.ca_file }}
       register: nomad_consul_ca_file
   tags: nomad
 
+- when: nomad_conf.tls.http and nomad_conf.server.enabled
+  block:
+    - name: Deploy jwks-proxy conf
+      template: src=jwks-proxy.conf.j2 dest={{ nomad_root_dir }}/jwks-proxy/nginx.conf
+      notify: reload nomad-jwks-proxy
+
+    - name: Deploy jwks-proxy unit
+      template: src=jwks-proxy.service.j2 dest=/etc/systemd/system/nomad-jwks-proxy.service
+      register: nomad_jwks_proxy_unit
+
+    - name: Deploy logrotate conf
+      template: src=logrotate.conf.j2 dest=/etc/logrotate.d/nomad-jwks-proxy
+  tags: nomad
+
+- name: Reload systemd
+  systemd: daemon_reload=true
+  when: nomad_jwks_proxy_unit is defined and nomad_jwks_proxy_unit.changed
+  tags: nomad
+
 - name: Copy consul cert as consul CA
   copy: src={{ nomad_conf.consul.cert_file }} dest={{ nomad_conf.consul.ca_file }} remote_src=True
   when: nomad_conf.consul.ca_file is defined and not nomad_consul_ca_file.stat.exists
@@ -138,20 +156,20 @@
   when: nomad_conf.client.enabled and 'docker' in nomad_enabled_task_drivers
   tags: nomad
 
-- name: Set sysctl
-  sysctl:
-    name: "{{ item.key }}"
-    value: "{{ item.val }}"
-    sysctl_file: /etc/sysctl.d/nomad.conf
-    state: "{{ (nomad_conf.client.enabled and 'docker' in nomad_enabled_task_drivers) | ternary('present', 'absent') }}"
-  loop:
-    - key: net.bridge.bridge-nf-call-arptables
-      val: 1
-    - key: net.bridge.bridge-nf-call-ip6tables
-      val: 1
-    - key: net.bridge.bridge-nf-call-iptables
-      val: 1
-  tags: nomad
+#- name: Set sysctl
+#  sysctl:
+#    name: "{{ item.key }}"
+#    value: "{{ item.val }}"
+#    sysctl_file: /etc/sysctl.d/nomad.conf
+#    state: "{{ (nomad_conf.client.enabled and 'docker' in nomad_enabled_task_drivers) | ternary('present', 'absent') }}"
+#  loop:
+#    - key: net.bridge.bridge-nf-call-arptables
+#      val: 1
+#    - key: net.bridge.bridge-nf-call-ip6tables
+#      val: 1
+#    - key: net.bridge.bridge-nf-call-iptables
+#      val: 1
+#  tags: nomad
 
 - name: Deploy Docker auth config
   template: src=docker_auth.json.j2 dest={{ nomad_root_dir }}/docker/auth.json owner={{ nomad_user }} group={{ nomad_user }} mode=600

roles/nomad/tasks/directories.yml

@@ -33,6 +33,11 @@
       owner: root
       mode: 755
     - dir: tls
+    - dir: jwks-proxy
+    - dir: log
+      owner: "{{ nomad_user }}"
+      group: "{{ nomad_user }}"
+      mode: 700
   tags: nomad
 
 - name: Create host_volume directories

roles/nomad/tasks/install.yml

@@ -11,6 +11,11 @@
   notify: restart nomad
   tags: nomad
 
+- name: Install server only componenets
+  package: name={{ nomad_server_packages }}
+  when: nomad_conf.server.enabled
+  tags: nomad
+
 - name: Deploy systemd service unit
   template: src=nomad.service.j2 dest=/etc/systemd/system/nomad.service
   register: nomad_unit

roles/nomad/tasks/services.yml

@@ -29,4 +29,9 @@
     - nomad_conf.client.task_drivers.podman.enabled
   tags: nomad
 
-
+- name: Handle jwks-proxy service
+  service:
+    name: nomad-jwks-proxy
+    state: "{{ (nomad_conf.tls.http and nomad_conf.server.enabled) | ternary('started', 'stopped') }}"
+    enabled: "{{ (nomad_conf.tls.http and nomad_conf.server.enabled) | ternary(true, false) }}"
+  tags: nomad