Update to 2022-03-19 19:00

roles/lemonldap_ng/defaults/main.yml

@@ -66,6 +66,9 @@ llng_db_user: lemonldapng
 llng_handler_db_user: lemonldapnghandler
 # llng_db_pass: s3cr3t.
 # llng_handler_db_pass
+# Should database connections use SSL
+llng_db_ssl: False
+llng_db_ssl_ca: /etc/pki/tls/cert.pem
 
 # Number of llng-fastcgi-server or uwsgi workers. The upstream default is 7 but you might need to adjust to your load
 llng_workers: 6

roles/lemonldap_ng/templates/lemonldap-ng.ini.j2

@@ -24,7 +24,7 @@ localSessionStorageOptions = {                        \
 {% for type in llng_session_tables.keys() | list %}
 {{ type }}Storage        = Apache::Session::Browseable::MySQL
 {{ type }}StorageOptions = { \
-  'DataSource'     => 'DBI:mysql:database={{ llng_db_name }};host={{ llng_db_server }};mysql_enable_utf8=1', \
+  'DataSource'     => 'DBI:mysql:database={{ llng_db_name }};host={{ llng_db_server }};mysql_enable_utf8=1{% if llng_db_ssl %};mysql_ssl=1;mysql_ssl_ca_file={{ llng_db_ssl_ca }};mysql_ssl_verify_server_cert=1{% endif +%}', \
   'UserName'       => '{{ llng_handler_db_user }}', \
   'Password'       => '{{ llng_handler_db_pass }}', \
   'TableName'      => '{{ llng_session_tables[type].name }}', \
@@ -50,7 +50,7 @@ Password            = {{ llng_api_pass }}
 proxyOptions        = { timeout => 5 }
 {% elif llng_conf_backend == 'mysql' %}
 type                = CDBI
-dbiChain            = DBI:mysql:database={{ llng_db_name }};host={{ llng_db_server }}
+dbiChain            = DBI:mysql:database={{ llng_db_name }};host={{ llng_db_server }};mysql_enable_utf8=1{% if llng_db_ssl %};mysql_ssl=1;mysql_ssl_ca_file={{ llng_db_ssl_ca }};mysql_ssl_verify_server_cert=1{% endif +%}
 dbiUser             = {{ (llng_manager or llng_portal) | ternary(llng_db_user,llng_handler_db_user) }}
 dbiPassword         = {{ (llng_manager or llng_portal) | ternary(llng_db_pass,llng_handler_db_pass) }}
 {% endif %}

roles/letsencrypt/templates/domains.txt.j2

@@ -52,3 +52,6 @@
 {% if pg_letsencrypt_cert is defined and pg_letsencrypt_cert is string and pg_letsencrypt_cert not in letsencrypt_certs | default([]) | map(attribute='common_name') %}
 {{ pg_letsencrypt_cert }}
 {% endif %}
+{% if mysql_letsencrypt_cert is defined and mysql_letsencrypt_cert is string and mysql_letsencrypt_cert not in letsencrypt_certs | default([]) | map(attribute='common_name') %}
+{{ mysql_letsencrypt_cert }}
+{% endif %}

roles/mysql_server/defaults/main.yml

@@ -13,6 +13,15 @@ mysql_open_files_limit: 8192
 mysql_max_allowed_packet: 32M
 mysql_max_connections: 300
 
+# If mysql_letsencrypt_cert is defined, it'll turn SSL on and configure cert to use
+# mysql_letsencrypt_cert: mysql.example.org
+
+# ELse, it's possible to configure SSL manually
+mysql_ssl: "{{ (mysql_letsencrypt_cert is defined) | ternary(True, False) }}"
+mysql_ssl_cert: /etc/my.ssl/server.crt
+mysql_ssl_key: /etc/my.ssl/server.key
+mysql_ssl_ca: /etc/pki/tls/cert.pem
+
 # Engine can be either mariadb or mysql
 mysql_engine: mariadb
 

roles/mysql_server/tasks/main.yml

@@ -21,6 +21,23 @@
   package: name={{ mysql_server_packages }}
   tags: mysql
 
+- name: Create ssl directory
+  file: path=/etc/my.ssl state=directory owner=root group=mysql mode=750
+  tags: mysql
+
+- name: Create default self-signed cert
+  import_tasks: ../includes/create_selfsigned_cert.yml
+  vars:
+    - cert_path: /etc/my.ssl/server.crt
+    - cert_key_path: /etc/my.ssl/server.key
+    - cert_key_group: mysql
+    - cert_key_mode: '640'
+  tags: mysql
+
+- name: Deploy dehydrated hook
+  template: src=dehydrated_hook.j2 dest=/etc/dehydrated/hooks_deploy_cert.d/mysql mode=755
+  tags: mysql
+
 - name: Deploy backup scripts
   template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/mysql mode=755
   loop:

roles/mysql_server/templates/dehydrated_hook.j2

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+{% if mysql_letsencrypt_cert is defined %}
+
+if [ $1 == "{{ pg_letsencrypt_cert }}" ]; then
+  cp /var/lib/dehydrated/certificates/certs/{{ mysql_letsencrypt_cert }}/fullchain.pem /etc/my.ssl/server.crt
+  cp /var/lib/dehydrated/certificates/certs/{{ mysql_letsencrypt_cert }}/privkey.pem /etc/my.ssl/server.key
+  chown root:mysql /etc/my.ssl/server.key
+  chown root:root /etc/my.ssl/server.crt
+  chmod 640 /etc/my.ssl/server.key
+  chmod 644 /etc/my.ssl/server.crt
+  mysql -e 'FLUSH SSL;'
+fi
+
+{% else %}
+
+# No Let's Encrypt cert configured, nothing to do
+exit 0
+
+{% endif %}

roles/mysql_server/templates/my.cnf.j2

@@ -35,6 +35,12 @@ max_allowed_packet={{ mysql_max_allowed_packet | default('16M') }}
 open_files_limit={{ mysql_open_files_limit | default('8192') }}
 max_connections={{ mysql_max_connections | default('300') }}
 
+{% if mysql_ssl %}
+ssl_cert={{ mysql_ssl_cert }}
+ssl_key={{ mysql_ssl_key }}
+ssl_ca={{ mysql_ssl_ca }}
+{% endif %}
+
 [mysqld_safe]
 {% if mysql_engine == 'mysql' %}
 log-error=/var/log/mysql/mysqld.log

roles/phpmyadmin/templates/config.inc.php.j2

@@ -22,6 +22,15 @@ $cfg['Servers'][$i]['port'] = '{{ server.port }}';
 {% endif %}
 $cfg['Servers'][$i]['compress'] = false;
 $cfg['Servers'][$i]['AllowNoPassword'] = false;
+{% if server.ssl | default(False) %}
+$cfg['Servers'][$i]['ssl'] = true;
+{% if server.ssl_ca | default('/etc/pki/tls/cert.pem') != False %}
+$cfg['Servers'][$i]['ssl_ca'] = '{{ server.ssl_ca | default('/etc/pki/tls/cert.pem') }}';
+{% endif %}
+{% if server.ssl_verify | default(True) == False %}
+$cfg['Servers'][$i]['ssl_verify'] = false;
+{% endif %}
+{% endif %}
 
 {% endfor %}