From 985867012b2001f16e697287dec9e6a5447f389c Mon Sep 17 00:00:00 2001
From: Andrea Dell'Amico <adellam@isti.cnr.it>
Date: Thu, 14 Feb 2019 22:44:29 +0100
Subject: [PATCH] Configure the httpd server and the letsencrypt hook for the
 ipa server.

---
 ipa-server/defaults/main.yml                  |  4 +--
 ipa-server/handlers/main.yml                  |  7 +++++
 ipa-server/tasks/main.yml                     | 23 +++++++++++++---
 .../templates/ipa-letsencrypt-acmetool.sh     | 27 +++++++++++++++++++
 .../templates/letsencrypt-proxy.conf.j2       |  1 +
 5 files changed, 56 insertions(+), 6 deletions(-)
 create mode 100644 ipa-server/handlers/main.yml
 create mode 100644 ipa-server/templates/ipa-letsencrypt-acmetool.sh
 create mode 100644 ipa-server/templates/letsencrypt-proxy.conf.j2

diff --git a/ipa-server/defaults/main.yml b/ipa-server/defaults/main.yml
index 1e039d5..1769274 100644
--- a/ipa-server/defaults/main.yml
+++ b/ipa-server/defaults/main.yml
@@ -13,7 +13,7 @@ ipa_server_dns_packages:
 
 # Comando di installazione
 # installazione di rng-tools
-ipa_installation_options: '--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/cert.pem --http-cert-file=/etc/pki/ipa/cert.pem --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=s2i2s-master@isti.cnr.it'
-
+ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/cert.pem --dirsrv-cert-file=/etc/pki/ipa/cert-key.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/cert.pem --http-cert-file=/etc/pki/ipa/cert-key.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=s2i2s-master@isti.cnr.it"
+ 
 ipa_ssl_letsencrypt_managed: True
 ipa_letsencrypt_ca_filename: lets-encrypt-x3-cross-signed.pem
diff --git a/ipa-server/handlers/main.yml b/ipa-server/handlers/main.yml
new file mode 100644
index 0000000..c82513c
--- /dev/null
+++ b/ipa-server/handlers/main.yml
@@ -0,0 +1,7 @@
+---
+- name: httpd reload
+  service: name=httpd state=reloaded
+
+- name: apache2 reload
+  service: name=apache2 state=reload
+
diff --git a/ipa-server/tasks/main.yml b/ipa-server/tasks/main.yml
index 09e8d00..6c9057c 100644
--- a/ipa-server/tasks/main.yml
+++ b/ipa-server/tasks/main.yml
@@ -1,10 +1,14 @@
 ---
 - block:
-#  - name: Create the acme hooks directory if it does not yet exist
-#    file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
+  - name: Install the apache letsencrypt directives on trusty
+    template: src=letsencrypt-proxy.conf.j2 dest=/etc/apache2/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
+    notify: httpd reload
+    
+  - name: Create the acme hooks directory if it does not yet exist
+    file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
 
-#  - name: Install a script that fix the letsencrypt certificate for ipa and then reload the service
-#    template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555
+  - name: Install a script that fix the letsencrypt certificate for ipa and then reload the service
+    template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555
 
   - name: Create the ipa certificate directory
     file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750
@@ -12,6 +16,12 @@
   - name: Install the Letsencrypt CA file with both the root and the trusted CAs
     copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0444
 
+  - name: Copy the certificate file into /etc/pki/ipa
+    copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True
+
+  - name: Copy the certificate key file into /etc/pki/ipa
+    copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True
+
   when:
     - ipa_ssl_letsencrypt_managed
     - letsencrypt_acme_install
@@ -24,6 +34,11 @@
   - name: Install the FreeIPA DNS server packages
     yum: pkg={{ ipa_server_dns_packages }} state=present
 
+  - name: Run the ipa-server-install command unattended.
+    command: ipa-server-install {{ ipa_installation_options }}
+    args:
+      creates: /var/lib/ipa/dnssec/softhsm_pin
+    
   when:
     - ipa_server_install
     - ansible_distribution_file_variety == "RedHat"
diff --git a/ipa-server/templates/ipa-letsencrypt-acmetool.sh b/ipa-server/templates/ipa-letsencrypt-acmetool.sh
new file mode 100644
index 0000000..47522ac
--- /dev/null
+++ b/ipa-server/templates/ipa-letsencrypt-acmetool.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+LE_LOG_DIR=/var/log/acme
+LOG_FILE="$LE_LOG_DIR/ipa-server.log"
+DATE=$( date )
+
+[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
+echo "$DATE" >> $LOG_FILE
+
+if [ -f /etc/default/letsencrypt ] ; then
+    . /etc/default/letsencrypt
+else
+    echo "No letsencrypt default file" >> $LOG_FILE
+fi
+
+krb_realm=$( grep realm /etc/ipa/default.conf | awk '{ print $3 }' )
+
+/bin/cp -f "$LE_CERTS_DIR/fullchain" /etc/pki/ipa/cert.pem
+/bin/cp -f "$LE_CERTS_DIR/privkey" /etc/pki/ipa/cert-key.pem
+
+ipa-server-certinstall -w -d /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem --pin='' -p '' 
+systemctl reload httpd
+systemctl restart "dirsrv@${krb_realm//./-}.service"
+
+echo "Done." >> $LOG_FILE
+
+exit 0
diff --git a/ipa-server/templates/letsencrypt-proxy.conf.j2 b/ipa-server/templates/letsencrypt-proxy.conf.j2
new file mode 100644
index 0000000..4dddd47
--- /dev/null
+++ b/ipa-server/templates/letsencrypt-proxy.conf.j2
@@ -0,0 +1 @@
+ProxyPass "/.well-known/acme-challenge" "http://127.0.0.1:{{ letsencrypt_acme_standalone_port}}/.well-known/acme-challenge"