From 4abb469672f2b7246bf490146d75c31487a39b79 Mon Sep 17 00:00:00 2001 From: Andrea Dell'Amico Date: Fri, 24 Apr 2020 16:16:17 +0200 Subject: [PATCH] FreeIPA: refine the role, add a command line example of a replica configuration. --- library/roles/ipa-server/defaults/main.yml | 18 +++++-- library/roles/ipa-server/tasks/main.yml | 51 +++++++++++++++---- .../templates/ipa-letsencrypt-acmetool.sh | 7 +-- 3 files changed, 56 insertions(+), 20 deletions(-) diff --git a/library/roles/ipa-server/defaults/main.yml b/library/roles/ipa-server/defaults/main.yml index 04dda161..0d09caba 100644 --- a/library/roles/ipa-server/defaults/main.yml +++ b/library/roles/ipa-server/defaults/main.yml @@ -2,19 +2,31 @@ # See https://github.com/antevens/letsencrypt-freeipa for the letsencrypt hints ipa_server_install: False ipa_server_use_dns: True +ipa_server_is_master: False ipa_server_domain: example.org ipa_server_realm: '{{ ipa_server_domain | upper }}' ipa_server_packages: - ipa-server + - rng-tools + - ntp ipa_server_dns_packages: - ipa-server-dns -# Comando di installazione -# installazione di rng-tools -ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/cert.pem --dirsrv-cert-file=/etc/pki/ipa/cert-key.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/cert.pem --http-cert-file=/etc/pki/ipa/cert-key.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=s2i2s-master@isti.cnr.it" +ipa_packages_to_remove: + - chrony + +# Installation command +# It uses letsencrypt certificates +ipa_installation_options: "--ca-cert-file=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} --dirsrv-cert-file=/etc/pki/ipa/fullchain.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/fullchain.pem --http-pin='' --no-pkinit -r {{ ipa_server_realm }} -n {{ ipa_server_domain }} -a {{ ipa_admin_password }} -p {{ ipa_manager_password }} --hostname={{ ansible_fqdn }} -U --setup-dns --no-forwarders --no-reverse --zonemgr=hostmaster@xample.com" + +# Comand that installs a replica +ipa_replica_installation_command: "ipa-replica-install --no-reverse --setup-dns --no-forwarders --dirsrv-cert-file=/etc/pki/ipa/fullchain.pem --dirsrv-pin='' --http-cert-file=/etc/pki/ipa/fullchain.pem --http-pin='' --no-pkinit" +ipa_run_the_installation_command: True ipa_ssl_letsencrypt_managed: True +ipa_ssl_letsencrypt_use_hook: False ipa_letsencrypt_ca_filename: lets-encrypt-x3-cross-signed.pem +ipa_letsencrypt_cron_job_day: '1' \ No newline at end of file diff --git a/library/roles/ipa-server/tasks/main.yml b/library/roles/ipa-server/tasks/main.yml index 350fe0e4..28bc9c0e 100644 --- a/library/roles/ipa-server/tasks/main.yml +++ b/library/roles/ipa-server/tasks/main.yml @@ -13,40 +13,69 @@ - name: Create the acme hooks directory if it does not yet exist file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root - - name: Install a script that fix the letsencrypt certificate for ipa and then reload the service - template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555 + - name: Install a letsencrypt hook that fixes the letsencrypt certificate for ipa and then reloads the service + template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=0550 + when: ipa_ssl_letsencrypt_use_hook | bool + + - name: Install a script that fixes the letsencrypt certificate for ipa and then reloads the service + template: src=ipa-letsencrypt-acmetool.sh dest=/usr/local/bin/ipa-letsencrypt owner=root group=root mode=0500 + when: not ipa_ssl_letsencrypt_use_hook | bool + tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ] + + - name: Install a cron job that runs the ipa-letsencrypt script + cron: name="Refresh-the-letsencrypt-certificate-configured-in-FreeIPA" job="/usr/local/bin/ipa-letsencrypt >/var/log/acme/ipa-letsencrypt.log 2>&1" user=root hour="{{ range(1, 4) | random }}" minute="{{ range(0, 59) | random }}" day={{ ipa_letsencrypt_cron_job_day }} state=present + when: not ipa_ssl_letsencrypt_use_hook | bool + tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ] - name: Create the ipa certificate directory file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750 - name: Install the Letsencrypt CA file with both the root and the trusted CAs - copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0444 + copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0440 - name: Copy the certificate file into /etc/pki/ipa - copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True + copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True mode=0440 - name: Copy the certificate key file into /etc/pki/ipa - copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True + copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True mode=0440 + + - name: Put chain and cert in a single file. Needed once for the first configuration + shell: cat /etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem > /etc/pki/ipa/fullchain.pem ; chmod 400 /etc/pki/ipa/fullchain.pem + args: + creates: '/etc/pki/ipa/fullchain.pem' when: - - ipa_ssl_letsencrypt_managed - - letsencrypt_acme_install + - ipa_ssl_letsencrypt_managed | bool + - letsencrypt_acme_install | bool tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt' ] - block: - name: Install the FreeIPA server packages - yum: pkg={{ ipa_server_packages }} state=present + yum: pkg={{ ipa_server_packages }} state=latest - name: Install the FreeIPA DNS server packages - yum: pkg={{ ipa_server_dns_packages }} state=present + yum: pkg={{ ipa_server_dns_packages }} state=latest + - name: Remove the packages that conflict with the FreeIPA server configuration + yum: pkg={{ ipa_packages_to_remove }} state=absent + + - name: Ensure that the ntpd service is started and enabled + service: name=ntpd state=started enabled=yes + + when: + - ipa_server_install | bool + - ansible_distribution_file_variety == "RedHat" + tags: [ 'ipa' ] + +- block: - name: Run the ipa-server-install command unattended. command: ipa-server-install {{ ipa_installation_options }} args: creates: /var/lib/ipa/dnssec/softhsm_pin when: - - ipa_server_install + - ipa_server_install | bool + - ipa_server_is_master | bool - ansible_distribution_file_variety == "RedHat" - + - ipa_run_the_installation_command | bool tags: [ 'ipa' ] diff --git a/library/roles/ipa-server/templates/ipa-letsencrypt-acmetool.sh b/library/roles/ipa-server/templates/ipa-letsencrypt-acmetool.sh index 2f369cd3..c7efb1b3 100644 --- a/library/roles/ipa-server/templates/ipa-letsencrypt-acmetool.sh +++ b/library/roles/ipa-server/templates/ipa-letsencrypt-acmetool.sh @@ -7,16 +7,11 @@ DATE=$( date ) [ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR echo "$DATE" >> $LOG_FILE -if [ -f /etc/default/letsencrypt ] ; then - . /etc/default/letsencrypt -else - echo "No letsencrypt default file" >> $LOG_FILE -fi - krb_realm=$( grep realm /etc/ipa/default.conf | awk '{ print $3 }' ) /bin/cp -f "$LE_CERTS_DIR/fullchain" /etc/pki/ipa/cert.pem /bin/cp -f "$LE_CERTS_DIR/privkey" /etc/pki/ipa/cert-key.pem +chmod 400 /etc/pki/ipa/cert-key.pem ipa-server-certinstall -w -d /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem --pin='' -p '{{ ipa_manager_password }}' systemctl reload httpd