mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
70 lines
3.0 KiB
YAML
70 lines
3.0 KiB
YAML
---
|
|
- name: "🔐 Store the bootstrap root token in the container token helper"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao login -no-print -
|
|
args:
|
|
stdin: "{{ openbao_root_token }}"
|
|
stdin_add_newline: false
|
|
changed_when: false
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🧩 Enable the AppRole auth method"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'bao auth list -format=json | grep -q "approle/" || bao auth enable approle'
|
|
register: openbao_approle_enable
|
|
changed_when: openbao_approle_enable.rc == 0
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
|
|
- name: "📜 Write the ansible-admin policy the Ansible AppRole binds to"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao policy write ansible-admin {{ OPENBAO_POLICY_DIR_DOCKER }}/ansible-admin.hcl
|
|
changed_when: true
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
|
|
- name: "🧩 Create the Ansible AppRole"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}
|
|
token_policies=ansible-admin
|
|
token_ttl=30m
|
|
token_max_ttl=1h
|
|
secret_id_num_uses=0
|
|
secret_id_ttl=0
|
|
changed_when: true
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
|
|
- name: "🔑 Pin the RoleID to the inventory value"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}/role-id
|
|
role_id={{ OPENBAO_APPROLE_ROLE_ID | quote }}
|
|
changed_when: true
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
|
|
- name: "🔑 Pin the SecretID to the inventory value"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}/custom-secret-id
|
|
secret_id=-
|
|
args:
|
|
stdin: "{{ OPENBAO_APPROLE_SECRET_ID }}"
|
|
stdin_add_newline: false
|
|
changed_when: true
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🧹 Revoke the bootstrap root token"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'bao token revoke -self && rm -f ~/.bao-token'
|
|
changed_when: true
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
|
|
- name: "🔓 Forget the root token"
|
|
ansible.builtin.set_fact:
|
|
openbao_root_token: ""
|