diff --git a/roles/init/tasks/common.yml b/roles/init/tasks/common.yml index 2822022..282cb0b 100755 --- a/roles/init/tasks/common.yml +++ b/roles/init/tasks/common.yml @@ -72,172 +72,3 @@ regexp: "^127.0.0.1 .*" line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}" state: present - - - name: Install required dependencies - ansible.builtin.dnf: - name: - - dnf-plugins-core - - curl - state: present - - - name: Add HashiCorp repository - ansible.builtin.get_url: - url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo - dest: /etc/yum.repos.d/hashicorp.repo - mode: "0644" - - - name: Clean DNF cache - ansible.builtin.command: dnf clean all - changed_when: false - - - name: Install Vault - ansible.builtin.dnf: - name: vault - state: present - update_cache: yes - - - name: Set vault address - copy: - dest: /etc/profile.d/vault.sh - content: "export VAULT_ADDR=http://vault.home.lan:8205\n" - owner: root - group: root - mode: '0644' - - - name: Read SSH CA public key from Vault - ansible.builtin.command: - cmd: vault read -field=public_key ssh/config/ca - register: vault_ca - changed_when: false - environment: - VAULT_ADDR: "{{ vault_addr }}" - VAULT_TOKEN: "{{ vault_token }}" - - - name: Install trusted SSH user CA - ansible.builtin.copy: - content: "{{ vault_ca.stdout }}\n" - dest: /etc/ssh/trusted-user-ca-keys.pem - owner: root - group: root - mode: '0644' - - - name: Enable Trusted User CA - ansible.builtin.lineinfile: - path: /etc/ssh/sshd_config - regexp: "^TrustedUserCAKeys" - line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem" - state: present - - - name: Enable PubkeyAuthentication - ansible.builtin.lineinfile: - path: /etc/ssh/sshd_config - regexp: "^PubkeyAuthentication.*" - line: "PubkeyAuthentication yes" - state: present - - - name: Create vault agent dir - file: - path: /etc/vault-agent - state: directory - owner: root - group: root - mode: '0644' - - - name: Create vault agent config - copy: - dest: /etc/vault-agent/config.hcl - content: | - vault { - address = "http://vault.home.lan:8205" - } - - auto_auth { - method "approle" { - mount_path = "auth/approle" - - config = { - role_id_file_path = "/etc/vault-agent/role_id" - secret_id_file_path = "/etc/vault-agent/secret_id" - remove_secret_id_file_after_reading = false - } - } - - sink "file" { - config = { - path = "/tmp/vault-token" - } - } - } - - template { - destination = "/home/jd/.ssh/id_ed25519-cert.pub" - perms = "0644" - user = "jd" - group = "jd" - contents = <