FreeIPA: refine the role, add a command line example of a replica configuration.

library/roles/ipa-server/defaults/main.yml

@@ -2,19 +2,31 @@
 # See https://github.com/antevens/letsencrypt-freeipa for the letsencrypt hints
 ipa_server_install: False
 ipa_server_use_dns: True
+ipa_server_is_master: False
 
 ipa_server_domain: example.org
 ipa_server_realm: '{{ ipa_server_domain | upper }}'
 
 ipa_server_packages:
   - ipa-server
+  - rng-tools
+  - ntp
 
 ipa_server_dns_packages:
   - ipa-server-dns
 
-# Comando di installazione
+ipa_packages_to_remove:
-# installazione di rng-tools
+  - chrony
-ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/cert.pem --dirsrv-cert-file=/etc/pki/ipa/cert-key.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/cert.pem --http-cert-file=/etc/pki/ipa/cert-key.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=s2i2s-master@isti.cnr.it"
 
+# Installation command
+# It uses letsencrypt certificates
+ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/fullchain.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/fullchain.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=hostmaster@xample.com"
+
+# Comand that installs a replica
+ipa_replica_installation_command: "ipa-replica-install --no-reverse --setup-dns --no-forwarders --dirsrv-cert-file=/etc/pki/ipa/fullchain.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/fullchain.pem --http-pin='' --no-pkinit"
+ 
+ipa_run_the_installation_command: True
 ipa_ssl_letsencrypt_managed: True
+ipa_ssl_letsencrypt_use_hook: False
 ipa_letsencrypt_ca_filename: lets-encrypt-x3-cross-signed.pem
+ipa_letsencrypt_cron_job_day: '1'

library/roles/ipa-server/tasks/main.yml

@@ -13,40 +13,69 @@
   - name: Create the acme hooks directory if it does not yet exist
     file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
 
-  - name: Install a script that fix the letsencrypt certificate for ipa and then reload the service
+  - name: Install a letsencrypt hook that fixes the letsencrypt certificate for ipa and then reloads the service
-    template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555
+    template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=0550
+    when: ipa_ssl_letsencrypt_use_hook | bool
+
+  - name: Install a script that fixes the letsencrypt certificate for ipa and then reloads the service
+    template: src=ipa-letsencrypt-acmetool.sh dest=/usr/local/bin/ipa-letsencrypt owner=root group=root mode=0500
+    when: not ipa_ssl_letsencrypt_use_hook | bool
+    tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]
+
+  - name: Install a cron job that runs the ipa-letsencrypt script
+    cron: name="Refresh-the-letsencrypt-certificate-configured-in-FreeIPA" job="/usr/local/bin/ipa-letsencrypt >/var/log/acme/ipa-letsencrypt.log 2>&1" user=root hour="{{ range(1, 4) | random }}" minute="{{ range(0, 59) | random }}" day={{ ipa_letsencrypt_cron_job_day }} state=present
+    when: not ipa_ssl_letsencrypt_use_hook | bool
+    tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]
 
   - name: Create the ipa certificate directory
     file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750
 
   - name: Install the Letsencrypt CA file with both the root and the trusted CAs
-    copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0444
+    copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0440
 
   - name: Copy the certificate file into /etc/pki/ipa
-    copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True
+    copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True  mode=0440
 
   - name: Copy the certificate key file into /etc/pki/ipa
-    copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True
+    copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True  mode=0440
+
+  - name: Put chain and cert in a single file. Needed once for the first configuration
+    shell: cat /etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem > /etc/pki/ipa/fullchain.pem ; chmod 400 /etc/pki/ipa/fullchain.pem
+    args:
+      creates: '/etc/pki/ipa/fullchain.pem'
 
   when:
-    - ipa_ssl_letsencrypt_managed
+    - ipa_ssl_letsencrypt_managed | bool
-    - letsencrypt_acme_install
+    - letsencrypt_acme_install | bool
   tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt' ]
 
 - block:
   - name: Install the FreeIPA server packages
-    yum: pkg={{ ipa_server_packages }} state=present
+    yum: pkg={{ ipa_server_packages }} state=latest
 
   - name: Install the FreeIPA DNS server packages
-    yum: pkg={{ ipa_server_dns_packages }} state=present
+    yum: pkg={{ ipa_server_dns_packages }} state=latest
 
+  - name: Remove the packages that conflict with the FreeIPA server configuration
+    yum: pkg={{ ipa_packages_to_remove }} state=absent
+
+  - name: Ensure that the ntpd service is started and enabled
+    service: name=ntpd state=started enabled=yes
+
+  when:
+    - ipa_server_install | bool
+    - ansible_distribution_file_variety == "RedHat"
+  tags: [ 'ipa' ]
+
+- block:
   - name: Run the ipa-server-install command unattended.
     command: ipa-server-install {{ ipa_installation_options }}
     args:
       creates: /var/lib/ipa/dnssec/softhsm_pin
     
   when:
-    - ipa_server_install
+    - ipa_server_install | bool
+    - ipa_server_is_master | bool
     - ansible_distribution_file_variety == "RedHat"
-
+    - ipa_run_the_installation_command | bool
   tags: [ 'ipa' ]

library/roles/ipa-server/templates/ipa-letsencrypt-acmetool.sh

@@ -7,16 +7,11 @@ DATE=$( date )
 [ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
 echo "$DATE" >> $LOG_FILE
 
-if [ -f /etc/default/letsencrypt ] ; then
-    . /etc/default/letsencrypt
-else
-    echo "No letsencrypt default file" >> $LOG_FILE
-fi
-
 krb_realm=$( grep realm /etc/ipa/default.conf | awk '{ print $3 }' )
 
 /bin/cp -f "$LE_CERTS_DIR/fullchain" /etc/pki/ipa/cert.pem
 /bin/cp -f "$LE_CERTS_DIR/privkey" /etc/pki/ipa/cert-key.pem
+chmod 400 /etc/pki/ipa/cert-key.pem
 
 ipa-server-certinstall -w -d /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem --pin='' -p '{{ ipa_manager_password }}' 
 systemctl reload httpd