jpp/ansible-roles
1
0
Fork 0
mirror of https://git.lapiole.org/dani/ansible-roles.git synced 2025-08-06 16:46:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update to 2023-07-05 19:00

Browse Source
This commit is contained in:
Daniel Berteaud
2023-07-05 19:00:07 +02:00
parent 0cc589ae4b
commit 8471af248b
25 changed files with 254 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
roles/consul/tasks/conf.yml
View File

@@ -1,24 +1,27 @@
---
# Ensure certificates exists. This is needed so first consul service starts doesn't fail
# when consul-template hasn't populated the cert yet
# when vault-agent hasn't populated the cert yet
- name: Generate self-signed certificate
import_tasks: ../includes/create_selfsigned_cert.yml
vars:
cert_path: "{{ consul_conf.tls.defaults.cert_file }}"
cert_key_path: "{{ consul_conf.tls.defaults.key_file }}"
cert_key_user: "{{ consul_user }}"
cert_key_group: "{{ consul_user }}"
cert_key_mode: 640
cert_key_mode: 660
when: consul_conf.tls.enabled
tags: consul
- name: Check if CA exists
stat: path={{ consul_conf.tls.defaults.ca_file }}
register: consul_ca_file
when: consul_conf.tls.enabled
tags: consul
- name: Copy cert as CA
copy: src={{ consul_conf.tls.defaults.cert_file }} dest={{ consul_conf.tls.defaults.ca_file }} remote_src=True
when: not consul_ca_file.stat.exists
when: consul_conf.tls.enabled and not consul_ca_file.stat.exists
tags: consul
- name: Deploy consul configuration
@@ -94,33 +97,38 @@
loop: "{{ consul_backup_configs.stdout_lines }}"
tags: consul
- name: Deploy consul-template config
template: src=consul-template.hcl.j2 dest={{ consul_root_dir }}/consul-template/consul-template.hcl mode=600 owner=root group=root
notify: restart consul-template-consul
when: consul_vault_secrets.pki.enabled or consul_vault_secrets.tokens.enabled
- name: Deploy vault agent configuration
template: src=vault/agent.hcl.j2 dest={{ consul_root_dir }}/vault/agent.hcl mode=640 owner=root group={{ consul_user }}
notify: restart consul-vault-agent
when: consul_vault_agent.pki.enabled
tags: consul
- name: Deploy agent bundle template
template: src=agent_bundle.pem.tpl.j2 dest={{ consul_root_dir }}/consul-template/agent_bundle.pem.tpl owner=root group=root
notify: restart consul-template-consul
when: consul_vault_secrets.pki.enabled
- name: Deploy agent cert bundle template
template: src=vault/agent_bundle.pem.tpl.j2 dest={{ consul_root_dir }}/vault/templates/agent_bundle.pem.tpl owner=root group=root
notify: restart consul-vault-agent
when: consul_vault_agent.pki.enabled
tags: consul
- name: Deploy consul-template cli bundle template
template: src=cli_bundle.pem.tpl.j2 dest={{ consul_root_dir }}/consul-template/cli_bundle.pem.tpl owner=root group=root
notify: restart consul-template-consul
when: consul_vault_secrets.pki.enabled and consul_conf.server
tags: consul
- name: Deploy the consul-template agent token template
template: src=agent.token.tpl.j2 dest={{ consul_root_dir }}/consul-template/agent.token.tpl owner=root group=root
notify: restart consul-template-consul
when: consul_vault_secrets.tokens.enabled
- when:
- consul_vault_agent.auth is defined
- consul_vault_agent.auth.approle is defined
- consul_vault_agent.auth.approle.role_id is defined
- consul_vault_agent.auth.approle.secret_id is defined
name: Setup AppRole auth
block:
- copy: content={{ consul_vault_agent.auth.approle.role_id }} dest={{ consul_root_dir }}/vault/role_id owner=root group={{ consul_user }} mode=640
- copy: content={{ consul_vault_agent.auth.approle.secret_id }} dest={{ consul_root_dir }}/vault/secret_id owner=root group={{ consul_user }} mode=640
tags: consul
- name: Set ACL on the TLS dir
shell: |
setfacl -R -b -k {{ consul_root_dir }}/tls
chown -R {{ consul_user }}:{{ consul_user }} {{ consul_root_dir }}/tls
chmod 775 {{ consul_root_dir }}/tls
chmod 660 {{ consul_root_dir }}/tls/*
setfacl -m u:{{ consul_user }}:rwx {{ consul_root_dir }}/tls
setfacl -m d:u:{{ consul_user }}:rw {{ consul_root_dir }}/tls
setfacl -m u:{{ consul_user }}:rw {{ consul_root_dir }}/tls/*
{% if consul_admin_groups | length > 0 %}
setfacl -m {% for group in consul_admin_groups %}g:{{ group }}:rx{{ ',' if not loop.last }}{% endfor %} {{ consul_root_dir }}/tls
setfacl -m {% for group in consul_admin_groups %}d:g:{{ group }}:r{{ ',' if not loop.last }}{% endfor %} {{ consul_root_dir }}/tls