FreeIPA: refine the role, add a command line example of a replica configuration.
This commit is contained in:
parent
7b870305f7
commit
4abb469672
|
|
@ -2,19 +2,31 @@
|
|||
# See https://github.com/antevens/letsencrypt-freeipa for the letsencrypt hints
|
||||
ipa_server_install: False
|
||||
ipa_server_use_dns: True
|
||||
ipa_server_is_master: False
|
||||
|
||||
ipa_server_domain: example.org
|
||||
ipa_server_realm: '{{ ipa_server_domain | upper }}'
|
||||
|
||||
ipa_server_packages:
|
||||
- ipa-server
|
||||
- rng-tools
|
||||
- ntp
|
||||
|
||||
ipa_server_dns_packages:
|
||||
- ipa-server-dns
|
||||
|
||||
# Comando di installazione
|
||||
# installazione di rng-tools
|
||||
ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/cert.pem --dirsrv-cert-file=/etc/pki/ipa/cert-key.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/cert.pem --http-cert-file=/etc/pki/ipa/cert-key.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=s2i2s-master@isti.cnr.it"
|
||||
ipa_packages_to_remove:
|
||||
- chrony
|
||||
|
||||
# Installation command
|
||||
# It uses letsencrypt certificates
|
||||
ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/fullchain.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/fullchain.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=hostmaster@xample.com"
|
||||
|
||||
# Comand that installs a replica
|
||||
ipa_replica_installation_command: "ipa-replica-install --no-reverse --setup-dns --no-forwarders --dirsrv-cert-file=/etc/pki/ipa/fullchain.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/fullchain.pem --http-pin='' --no-pkinit"
|
||||
|
||||
ipa_run_the_installation_command: True
|
||||
ipa_ssl_letsencrypt_managed: True
|
||||
ipa_ssl_letsencrypt_use_hook: False
|
||||
ipa_letsencrypt_ca_filename: lets-encrypt-x3-cross-signed.pem
|
||||
ipa_letsencrypt_cron_job_day: '1'
|
||||
|
|
@ -13,40 +13,69 @@
|
|||
- name: Create the acme hooks directory if it does not yet exist
|
||||
file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
|
||||
|
||||
- name: Install a script that fix the letsencrypt certificate for ipa and then reload the service
|
||||
template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555
|
||||
- name: Install a letsencrypt hook that fixes the letsencrypt certificate for ipa and then reloads the service
|
||||
template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=0550
|
||||
when: ipa_ssl_letsencrypt_use_hook | bool
|
||||
|
||||
- name: Install a script that fixes the letsencrypt certificate for ipa and then reloads the service
|
||||
template: src=ipa-letsencrypt-acmetool.sh dest=/usr/local/bin/ipa-letsencrypt owner=root group=root mode=0500
|
||||
when: not ipa_ssl_letsencrypt_use_hook | bool
|
||||
tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]
|
||||
|
||||
- name: Install a cron job that runs the ipa-letsencrypt script
|
||||
cron: name="Refresh-the-letsencrypt-certificate-configured-in-FreeIPA" job="/usr/local/bin/ipa-letsencrypt >/var/log/acme/ipa-letsencrypt.log 2>&1" user=root hour="{{ range(1, 4) | random }}" minute="{{ range(0, 59) | random }}" day={{ ipa_letsencrypt_cron_job_day }} state=present
|
||||
when: not ipa_ssl_letsencrypt_use_hook | bool
|
||||
tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]
|
||||
|
||||
- name: Create the ipa certificate directory
|
||||
file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750
|
||||
|
||||
- name: Install the Letsencrypt CA file with both the root and the trusted CAs
|
||||
copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0444
|
||||
copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0440
|
||||
|
||||
- name: Copy the certificate file into /etc/pki/ipa
|
||||
copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True
|
||||
copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True mode=0440
|
||||
|
||||
- name: Copy the certificate key file into /etc/pki/ipa
|
||||
copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True
|
||||
copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True mode=0440
|
||||
|
||||
- name: Put chain and cert in a single file. Needed once for the first configuration
|
||||
shell: cat /etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem > /etc/pki/ipa/fullchain.pem ; chmod 400 /etc/pki/ipa/fullchain.pem
|
||||
args:
|
||||
creates: '/etc/pki/ipa/fullchain.pem'
|
||||
|
||||
when:
|
||||
- ipa_ssl_letsencrypt_managed
|
||||
- letsencrypt_acme_install
|
||||
- ipa_ssl_letsencrypt_managed | bool
|
||||
- letsencrypt_acme_install | bool
|
||||
tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt' ]
|
||||
|
||||
- block:
|
||||
- name: Install the FreeIPA server packages
|
||||
yum: pkg={{ ipa_server_packages }} state=present
|
||||
yum: pkg={{ ipa_server_packages }} state=latest
|
||||
|
||||
- name: Install the FreeIPA DNS server packages
|
||||
yum: pkg={{ ipa_server_dns_packages }} state=present
|
||||
yum: pkg={{ ipa_server_dns_packages }} state=latest
|
||||
|
||||
- name: Remove the packages that conflict with the FreeIPA server configuration
|
||||
yum: pkg={{ ipa_packages_to_remove }} state=absent
|
||||
|
||||
- name: Ensure that the ntpd service is started and enabled
|
||||
service: name=ntpd state=started enabled=yes
|
||||
|
||||
when:
|
||||
- ipa_server_install | bool
|
||||
- ansible_distribution_file_variety == "RedHat"
|
||||
tags: [ 'ipa' ]
|
||||
|
||||
- block:
|
||||
- name: Run the ipa-server-install command unattended.
|
||||
command: ipa-server-install {{ ipa_installation_options }}
|
||||
args:
|
||||
creates: /var/lib/ipa/dnssec/softhsm_pin
|
||||
|
||||
when:
|
||||
- ipa_server_install
|
||||
- ipa_server_install | bool
|
||||
- ipa_server_is_master | bool
|
||||
- ansible_distribution_file_variety == "RedHat"
|
||||
|
||||
- ipa_run_the_installation_command | bool
|
||||
tags: [ 'ipa' ]
|
||||
|
|
|
|||
|
|
@ -7,16 +7,11 @@ DATE=$( date )
|
|||
[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
|
||||
echo "$DATE" >> $LOG_FILE
|
||||
|
||||
if [ -f /etc/default/letsencrypt ] ; then
|
||||
. /etc/default/letsencrypt
|
||||
else
|
||||
echo "No letsencrypt default file" >> $LOG_FILE
|
||||
fi
|
||||
|
||||
krb_realm=$( grep realm /etc/ipa/default.conf | awk '{ print $3 }' )
|
||||
|
||||
/bin/cp -f "$LE_CERTS_DIR/fullchain" /etc/pki/ipa/cert.pem
|
||||
/bin/cp -f "$LE_CERTS_DIR/privkey" /etc/pki/ipa/cert-key.pem
|
||||
chmod 400 /etc/pki/ipa/cert-key.pem
|
||||
|
||||
ipa-server-certinstall -w -d /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem --pin='' -p '{{ ipa_manager_password }}'
|
||||
systemctl reload httpd
|
||||
|
|
|
|||
Loading…
Reference in New Issue