Configure the httpd server and the letsencrypt hook for the ipa server.

This commit is contained in:
Andrea Dell'Amico 2019-02-14 22:44:29 +01:00
parent 19230c6ef7
commit 985867012b
5 changed files with 56 additions and 6 deletions

View File

@ -13,7 +13,7 @@ ipa_server_dns_packages:
# Comando di installazione
# installazione di rng-tools
ipa_installation_options: '--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/cert.pem --http-cert-file=/etc/pki/ipa/cert.pem --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=s2i2s-master@isti.cnr.it'
ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/cert.pem --dirsrv-cert-file=/etc/pki/ipa/cert-key.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/cert.pem --http-cert-file=/etc/pki/ipa/cert-key.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=s2i2s-master@isti.cnr.it"
ipa_ssl_letsencrypt_managed: True
ipa_letsencrypt_ca_filename: lets-encrypt-x3-cross-signed.pem

View File

@ -0,0 +1,7 @@
---
- name: httpd reload
service: name=httpd state=reloaded
- name: apache2 reload
service: name=apache2 state=reload

View File

@ -1,10 +1,14 @@
---
- block:
# - name: Create the acme hooks directory if it does not yet exist
# file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
- name: Install the apache letsencrypt directives on trusty
template: src=letsencrypt-proxy.conf.j2 dest=/etc/apache2/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
notify: httpd reload
- name: Create the acme hooks directory if it does not yet exist
file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
# - name: Install a script that fix the letsencrypt certificate for ipa and then reload the service
# template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555
- name: Install a script that fix the letsencrypt certificate for ipa and then reload the service
template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555
- name: Create the ipa certificate directory
file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750
@ -12,6 +16,12 @@
- name: Install the Letsencrypt CA file with both the root and the trusted CAs
copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0444
- name: Copy the certificate file into /etc/pki/ipa
copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True
- name: Copy the certificate key file into /etc/pki/ipa
copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True
when:
- ipa_ssl_letsencrypt_managed
- letsencrypt_acme_install
@ -24,6 +34,11 @@
- name: Install the FreeIPA DNS server packages
yum: pkg={{ ipa_server_dns_packages }} state=present
- name: Run the ipa-server-install command unattended.
command: ipa-server-install {{ ipa_installation_options }}
args:
creates: /var/lib/ipa/dnssec/softhsm_pin
when:
- ipa_server_install
- ansible_distribution_file_variety == "RedHat"

View File

@ -0,0 +1,27 @@
#!/bin/bash
LE_LOG_DIR=/var/log/acme
LOG_FILE="$LE_LOG_DIR/ipa-server.log"
DATE=$( date )
[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
echo "$DATE" >> $LOG_FILE
if [ -f /etc/default/letsencrypt ] ; then
. /etc/default/letsencrypt
else
echo "No letsencrypt default file" >> $LOG_FILE
fi
krb_realm=$( grep realm /etc/ipa/default.conf | awk '{ print $3 }' )
/bin/cp -f "$LE_CERTS_DIR/fullchain" /etc/pki/ipa/cert.pem
/bin/cp -f "$LE_CERTS_DIR/privkey" /etc/pki/ipa/cert-key.pem
ipa-server-certinstall -w -d /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem --pin='' -p ''
systemctl reload httpd
systemctl restart "dirsrv@${krb_realm//./-}.service"
echo "Done." >> $LOG_FILE
exit 0

View File

@ -0,0 +1 @@
ProxyPass "/.well-known/acme-challenge" "http://127.0.0.1:{{ letsencrypt_acme_standalone_port}}/.well-known/acme-challenge"