mirror of
https://gitlab.sectorq.eu/jaydee/ansible.git
synced 2026-09-08 21:27:36 +02:00
build-all
This commit is contained in:
@@ -0,0 +1,193 @@
|
||||
- name: Init Debian
|
||||
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
|
||||
block:
|
||||
- name: Ensure required packages are installed
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- gpg
|
||||
- wget
|
||||
- lsb-release
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Download HashiCorp GPG key
|
||||
ansible.builtin.get_url:
|
||||
url: https://apt.releases.hashicorp.com/gpg
|
||||
dest: /tmp/hashicorp.gpg
|
||||
mode: '0644'
|
||||
|
||||
- name: Convert HashiCorp GPG key to keyring format
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
gpg --dearmor
|
||||
-o /usr/share/keyrings/hashicorp-archive-keyring.gpg
|
||||
/tmp/hashicorp.gpg
|
||||
args:
|
||||
creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg
|
||||
|
||||
- name: Add HashiCorp repository
|
||||
ansible.builtin.apt_repository:
|
||||
repo: >-
|
||||
deb [arch={{ ansible_architecture == 'x86_64' | ternary('amd64', ansible_architecture) }}
|
||||
signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
|
||||
https://apt.releases.hashicorp.com
|
||||
{{ ansible_distribution_release }}
|
||||
main
|
||||
filename: hashicorp
|
||||
state: present
|
||||
|
||||
- name: Update apt cache
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
|
||||
- name: Install Vault
|
||||
ansible.builtin.apt:
|
||||
name: vault
|
||||
state: present
|
||||
|
||||
|
||||
- name: Set vault address
|
||||
copy:
|
||||
dest: /etc/profile.d/vault.sh
|
||||
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Read SSH CA public key from Vault
|
||||
ansible.builtin.command:
|
||||
cmd: vault read -field=public_key ssh/config/ca
|
||||
register: vault_ca
|
||||
changed_when: false
|
||||
environment:
|
||||
VAULT_ADDR: "{{ vault_addr }}"
|
||||
VAULT_TOKEN: "{{ vault_token }}"
|
||||
|
||||
- name: Install trusted SSH user CA
|
||||
ansible.builtin.copy:
|
||||
content: "{{ vault_ca.stdout }}\n"
|
||||
dest: /etc/ssh/trusted-user-ca-keys.pem
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable Trusted User CA
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^TrustedUserCAKeys"
|
||||
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
|
||||
state: present
|
||||
|
||||
- name: Enable PubkeyAuthentication
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^PubkeyAuthentication.*"
|
||||
line: "PubkeyAuthentication yes"
|
||||
state: present
|
||||
|
||||
- name: Create vault agent dir
|
||||
file:
|
||||
path: /etc/vault-agent
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create vault agent config
|
||||
copy:
|
||||
dest: /etc/vault-agent/config.hcl
|
||||
content: |
|
||||
vault {
|
||||
address = "http://vault.home.lan:8205"
|
||||
}
|
||||
|
||||
auto_auth {
|
||||
method "approle" {
|
||||
mount_path = "auth/approle"
|
||||
|
||||
config = {
|
||||
role_id_file_path = "/etc/vault-agent/role_id"
|
||||
secret_id_file_path = "/etc/vault-agent/secret_id"
|
||||
remove_secret_id_file_after_reading = false
|
||||
}
|
||||
}
|
||||
|
||||
sink "file" {
|
||||
config = {
|
||||
path = "/tmp/vault-token"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
|
||||
perms = "0644"
|
||||
user = "jd"
|
||||
group = "jd"
|
||||
contents = <<EOH
|
||||
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
|
||||
EOH
|
||||
}
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create file with token for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/token
|
||||
content: "{{ vault_sshcert_token }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with role_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/role_id
|
||||
content: "{{ vault_ssh_client_role_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with secret_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/secret_id
|
||||
content: "{{ vault_ssh_client_secret_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create service for vault agent
|
||||
copy:
|
||||
dest: /etc/systemd/system/vault-agent.service
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Vault Agent
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
|
||||
Restart=always
|
||||
User=root
|
||||
Group=root
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable and start vault agent service
|
||||
systemd:
|
||||
name: vault-agent
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: Restart sshd
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Sync time
|
||||
ansible.builtin.command:
|
||||
cmd: chronyc makestep
|
||||
changed_when: false
|
||||
@@ -0,0 +1,171 @@
|
||||
- name: Init
|
||||
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
|
||||
block:
|
||||
- name: Install required dependencies
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- dnf-plugins-core
|
||||
- curl
|
||||
state: present
|
||||
|
||||
- name: Add HashiCorp repository
|
||||
ansible.builtin.get_url:
|
||||
url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
|
||||
dest: /etc/yum.repos.d/hashicorp.repo
|
||||
mode: "0644"
|
||||
|
||||
- name: Clean DNF cache
|
||||
ansible.builtin.command: dnf clean all
|
||||
changed_when: false
|
||||
|
||||
- name: Install Vault
|
||||
ansible.builtin.dnf:
|
||||
name: vault
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Set vault address
|
||||
copy:
|
||||
dest: /etc/profile.d/vault.sh
|
||||
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Read SSH CA public key from Vault
|
||||
ansible.builtin.command:
|
||||
cmd: vault read -field=public_key ssh/config/ca
|
||||
register: vault_ca
|
||||
changed_when: false
|
||||
environment:
|
||||
VAULT_ADDR: "{{ vault_addr }}"
|
||||
VAULT_TOKEN: "{{ vault_token }}"
|
||||
|
||||
- name: Install trusted SSH user CA
|
||||
ansible.builtin.copy:
|
||||
content: "{{ vault_ca.stdout }}\n"
|
||||
dest: /etc/ssh/trusted-user-ca-keys.pem
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable Trusted User CA
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^TrustedUserCAKeys"
|
||||
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
|
||||
state: present
|
||||
|
||||
- name: Enable PubkeyAuthentication
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^PubkeyAuthentication.*"
|
||||
line: "PubkeyAuthentication yes"
|
||||
state: present
|
||||
|
||||
- name: Create vault agent dir
|
||||
file:
|
||||
path: /etc/vault-agent
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create vault agent config
|
||||
copy:
|
||||
dest: /etc/vault-agent/config.hcl
|
||||
content: |
|
||||
vault {
|
||||
address = "http://vault.home.lan:8205"
|
||||
}
|
||||
|
||||
auto_auth {
|
||||
method "approle" {
|
||||
mount_path = "auth/approle"
|
||||
|
||||
config = {
|
||||
role_id_file_path = "/etc/vault-agent/role_id"
|
||||
secret_id_file_path = "/etc/vault-agent/secret_id"
|
||||
remove_secret_id_file_after_reading = false
|
||||
}
|
||||
}
|
||||
|
||||
sink "file" {
|
||||
config = {
|
||||
path = "/tmp/vault-token"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
|
||||
perms = "0644"
|
||||
user = "jd"
|
||||
group = "jd"
|
||||
contents = <<EOH
|
||||
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
|
||||
EOH
|
||||
}
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create file with token for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/token
|
||||
content: "{{ vault_sshcert_token }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with role_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/role_id
|
||||
content: "{{ vault_ssh_client_role_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with secret_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/secret_id
|
||||
content: "{{ vault_ssh_client_secret_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create service for vault agent
|
||||
copy:
|
||||
dest: /etc/systemd/system/vault-agent.service
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Vault Agent
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
|
||||
Restart=always
|
||||
User=root
|
||||
Group=root
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable and start vault agent service
|
||||
systemd:
|
||||
name: vault-agent
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: Restart sshd
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Sync time
|
||||
ansible.builtin.command:
|
||||
cmd: chronyc makestep
|
||||
changed_when: false
|
||||
Executable
+243
@@ -0,0 +1,243 @@
|
||||
- name: Init
|
||||
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
|
||||
block:
|
||||
|
||||
- name: Include vault
|
||||
ansible.builtin.include_vars:
|
||||
file: init.yml
|
||||
- name: Change password for jd
|
||||
ansible.builtin.user:
|
||||
name: jd
|
||||
password: "{{ jd_password | password_hash('sha512') }}"
|
||||
- name: "Ensure sudo binary exist"
|
||||
stat:
|
||||
path: /usr/bin/sudo
|
||||
register: sudo_binary
|
||||
- name: "Install sudo if not present"
|
||||
package:
|
||||
name: sudo
|
||||
state: present
|
||||
when: not sudo_binary.stat.exists
|
||||
|
||||
- name: Check if group exists
|
||||
getent:
|
||||
database: group
|
||||
key: sudo
|
||||
register: group_check
|
||||
ignore_errors: true
|
||||
|
||||
- name: Ensure deploy user exists
|
||||
ansible.builtin.user:
|
||||
name: jd
|
||||
shell: /bin/bash
|
||||
groups: sudo
|
||||
append: true
|
||||
when: group_check is succeeded
|
||||
- name: Ensure directory sudoers.d exists
|
||||
file:
|
||||
path: /etc/sudoers.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Give jd passwordless sudo
|
||||
copy:
|
||||
dest: /etc/sudoers.d/jd
|
||||
content: "jd ALL=(ALL) NOPASSWD:ALL\n"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0440'
|
||||
|
||||
- name: Change password for root
|
||||
ansible.builtin.user:
|
||||
name: root
|
||||
password: "{{ jd_password | password_hash('sha512') }}"
|
||||
|
||||
- name: Update become password for subsequent tasks
|
||||
ansible.builtin.set_fact:
|
||||
ansible_become_password: "{{ jd_password }}"
|
||||
|
||||
- name: Set timezone to Europe/Bratislava
|
||||
ansible.builtin.command:
|
||||
cmd: timedatectl set-timezone Europe/Bratislava
|
||||
args:
|
||||
creates: /etc/timezone
|
||||
- name: Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ inventory_hostname }}"
|
||||
- name: Add host entry to /etc/hosts
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^127.0.0.1 .*"
|
||||
line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
|
||||
state: present
|
||||
|
||||
- name: Install required dependencies
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- dnf-plugins-core
|
||||
- curl
|
||||
state: present
|
||||
|
||||
- name: Add HashiCorp repository
|
||||
ansible.builtin.get_url:
|
||||
url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
|
||||
dest: /etc/yum.repos.d/hashicorp.repo
|
||||
mode: "0644"
|
||||
|
||||
- name: Clean DNF cache
|
||||
ansible.builtin.command: dnf clean all
|
||||
changed_when: false
|
||||
|
||||
- name: Install Vault
|
||||
ansible.builtin.dnf:
|
||||
name: vault
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Set vault address
|
||||
copy:
|
||||
dest: /etc/profile.d/vault.sh
|
||||
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Read SSH CA public key from Vault
|
||||
ansible.builtin.command:
|
||||
cmd: vault read -field=public_key ssh/config/ca
|
||||
register: vault_ca
|
||||
changed_when: false
|
||||
environment:
|
||||
VAULT_ADDR: "{{ vault_addr }}"
|
||||
VAULT_TOKEN: "{{ vault_token }}"
|
||||
|
||||
- name: Install trusted SSH user CA
|
||||
ansible.builtin.copy:
|
||||
content: "{{ vault_ca.stdout }}\n"
|
||||
dest: /etc/ssh/trusted-user-ca-keys.pem
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable Trusted User CA
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^TrustedUserCAKeys"
|
||||
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
|
||||
state: present
|
||||
|
||||
- name: Enable PubkeyAuthentication
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^PubkeyAuthentication.*"
|
||||
line: "PubkeyAuthentication yes"
|
||||
state: present
|
||||
|
||||
- name: Create vault agent dir
|
||||
file:
|
||||
path: /etc/vault-agent
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create vault agent config
|
||||
copy:
|
||||
dest: /etc/vault-agent/config.hcl
|
||||
content: |
|
||||
vault {
|
||||
address = "http://vault.home.lan:8205"
|
||||
}
|
||||
|
||||
auto_auth {
|
||||
method "approle" {
|
||||
mount_path = "auth/approle"
|
||||
|
||||
config = {
|
||||
role_id_file_path = "/etc/vault-agent/role_id"
|
||||
secret_id_file_path = "/etc/vault-agent/secret_id"
|
||||
remove_secret_id_file_after_reading = false
|
||||
}
|
||||
}
|
||||
|
||||
sink "file" {
|
||||
config = {
|
||||
path = "/tmp/vault-token"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
|
||||
perms = "0644"
|
||||
user = "jd"
|
||||
group = "jd"
|
||||
contents = <<EOH
|
||||
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
|
||||
EOH
|
||||
}
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create file with token for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/token
|
||||
content: "{{ vault_sshcert_token }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with role_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/role_id
|
||||
content: "{{ vault_ssh_client_role_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with secret_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/secret_id
|
||||
content: "{{ vault_ssh_client_secret_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create service for vault agent
|
||||
copy:
|
||||
dest: /etc/systemd/system/vault-agent.service
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Vault Agent
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
|
||||
Restart=always
|
||||
User=root
|
||||
Group=root
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable and start vault agent service
|
||||
systemd:
|
||||
name: vault-agent
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: Restart sshd
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Sync time
|
||||
ansible.builtin.command:
|
||||
cmd: chronyc makestep
|
||||
changed_when: false
|
||||
+10
-240
@@ -1,243 +1,13 @@
|
||||
- name: Init
|
||||
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
|
||||
block:
|
||||
- name: Include vault
|
||||
ansible.builtin.include_vars:
|
||||
file: jaydee.yml
|
||||
|
||||
- name: Include vault
|
||||
ansible.builtin.include_vars:
|
||||
file: init.yml
|
||||
- name: Change password for jd
|
||||
ansible.builtin.user:
|
||||
name: jd
|
||||
password: "{{ jd_password | password_hash('sha512') }}"
|
||||
- name: "Ensure sudo binary exist"
|
||||
stat:
|
||||
path: /usr/bin/sudo
|
||||
register: sudo_binary
|
||||
- name: "Install sudo if not present"
|
||||
package:
|
||||
name: sudo
|
||||
state: present
|
||||
when: not sudo_binary.stat.exists
|
||||
|
||||
- name: Check if group exists
|
||||
getent:
|
||||
database: group
|
||||
key: sudo
|
||||
register: group_check
|
||||
ignore_errors: true
|
||||
|
||||
- name: Ensure deploy user exists
|
||||
ansible.builtin.user:
|
||||
name: jd
|
||||
shell: /bin/bash
|
||||
groups: sudo
|
||||
append: true
|
||||
when: group_check is succeeded
|
||||
- name: Ensure directory sudoers.d exists
|
||||
file:
|
||||
path: /etc/sudoers.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Give jd passwordless sudo
|
||||
copy:
|
||||
dest: /etc/sudoers.d/jd
|
||||
content: "jd ALL=(ALL) NOPASSWD:ALL\n"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0440'
|
||||
- name: Facts
|
||||
ansible.builtin.setup:
|
||||
when: ansible_facts.architecture is not defined
|
||||
|
||||
- name: Change password for root
|
||||
ansible.builtin.user:
|
||||
name: root
|
||||
password: "{{ jd_password | password_hash('sha512') }}"
|
||||
- name: Include common tasks
|
||||
ansible.builtin.include_tasks: common.yml"
|
||||
|
||||
- name: Update become password for subsequent tasks
|
||||
ansible.builtin.set_fact:
|
||||
ansible_become_password: "{{ jd_password }}"
|
||||
|
||||
- name: Set timezone to Europe/Bratislava
|
||||
ansible.builtin.command:
|
||||
cmd: timedatectl set-timezone Europe/Bratislava
|
||||
args:
|
||||
creates: /etc/timezone
|
||||
- name: Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ inventory_hostname }}"
|
||||
- name: Add host entry to /etc/hosts
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^127.0.0.1 .*"
|
||||
line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
|
||||
state: present
|
||||
|
||||
- name: Install required dependencies
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- dnf-plugins-core
|
||||
- curl
|
||||
state: present
|
||||
|
||||
- name: Add HashiCorp repository
|
||||
ansible.builtin.get_url:
|
||||
url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
|
||||
dest: /etc/yum.repos.d/hashicorp.repo
|
||||
mode: "0644"
|
||||
|
||||
- name: Clean DNF cache
|
||||
ansible.builtin.command: dnf clean all
|
||||
changed_when: false
|
||||
|
||||
- name: Install Vault
|
||||
ansible.builtin.dnf:
|
||||
name: vault
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Set vault address
|
||||
copy:
|
||||
dest: /etc/profile.d/vault.sh
|
||||
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Read SSH CA public key from Vault
|
||||
ansible.builtin.command:
|
||||
cmd: vault read -field=public_key ssh/config/ca
|
||||
register: vault_ca
|
||||
changed_when: false
|
||||
environment:
|
||||
VAULT_ADDR: "{{ vault_addr }}"
|
||||
VAULT_TOKEN: "{{ vault_token }}"
|
||||
|
||||
- name: Install trusted SSH user CA
|
||||
ansible.builtin.copy:
|
||||
content: "{{ vault_ca.stdout }}\n"
|
||||
dest: /etc/ssh/trusted-user-ca-keys.pem
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable Trusted User CA
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^TrustedUserCAKeys"
|
||||
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
|
||||
state: present
|
||||
|
||||
- name: Enable PubkeyAuthentication
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^PubkeyAuthentication.*"
|
||||
line: "PubkeyAuthentication yes"
|
||||
state: present
|
||||
|
||||
- name: Create vault agent dir
|
||||
file:
|
||||
path: /etc/vault-agent
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create vault agent config
|
||||
copy:
|
||||
dest: /etc/vault-agent/config.hcl
|
||||
content: |
|
||||
vault {
|
||||
address = "http://vault.home.lan:8205"
|
||||
}
|
||||
|
||||
auto_auth {
|
||||
method "approle" {
|
||||
mount_path = "auth/approle"
|
||||
|
||||
config = {
|
||||
role_id_file_path = "/etc/vault-agent/role_id"
|
||||
secret_id_file_path = "/etc/vault-agent/secret_id"
|
||||
remove_secret_id_file_after_reading = false
|
||||
}
|
||||
}
|
||||
|
||||
sink "file" {
|
||||
config = {
|
||||
path = "/tmp/vault-token"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
|
||||
perms = "0644"
|
||||
user = "jd"
|
||||
group = "jd"
|
||||
contents = <<EOH
|
||||
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
|
||||
EOH
|
||||
}
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Create file with token for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/token
|
||||
content: "{{ vault_sshcert_token }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with role_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/role_id
|
||||
content: "{{ vault_ssh_client_role_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create file with secret_id for vault agent
|
||||
copy:
|
||||
dest: /etc/vault-agent/secret_id
|
||||
content: "{{ vault_ssh_client_secret_id }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Create service for vault agent
|
||||
copy:
|
||||
dest: /etc/systemd/system/vault-agent.service
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Vault Agent
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
|
||||
Restart=always
|
||||
User=root
|
||||
Group=root
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable and start vault agent service
|
||||
systemd:
|
||||
name: vault-agent
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: Restart sshd
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Sync time
|
||||
ansible.builtin.command:
|
||||
cmd: chronyc makestep
|
||||
changed_when: false
|
||||
- name: Include OS-specific tasks
|
||||
ansible.builtin.include_tasks: "{{ ansible_facts.os_family }}.yml"
|
||||
Reference in New Issue
Block a user