mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
58 lines
2.9 KiB
YAML
58 lines
2.9 KiB
YAML
---
|
|
- name: "🏛 Ensure the PKI secrets engine is mounted at '{{ OPENBAO_PKI_MOUNT }}'"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'bao secrets list -format=json | grep -q "\"{{ OPENBAO_PKI_MOUNT }}/\"" ||
|
|
{ bao secrets enable -path={{ OPENBAO_PKI_MOUNT | quote }} pki && echo OPENBAO_CHANGED; }'
|
|
register: openbao_pki_mount
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_pki_mount.stdout"
|
|
|
|
- name: "🔍 Check whether the internal root CA already exists"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'bao read -field=certificate {{ OPENBAO_PKI_MOUNT }}/cert/ca 2>/dev/null | grep -q "BEGIN CERTIFICATE"'
|
|
register: openbao_pki_ca
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "🏛 Generate the internal root CA"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao write -field=certificate {{ OPENBAO_PKI_MOUNT }}/root/generate/internal
|
|
common_name={{ ('Infinito.Nexus Internal CA (' ~ DOMAIN_PRIMARY ~ ')') | quote }}
|
|
issuer_name=infinito-root
|
|
ttl=87600h
|
|
changed_when: true
|
|
when: openbao_pki_ca.rc != 0
|
|
|
|
- name: "🔗 Configure the CA and CRL distribution URLs"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'set -e;
|
|
p={{ OPENBAO_PKI_MOUNT }}/config/urls;
|
|
before=$(bao read -format=json $p 2>/dev/null | grep -v request_id || true);
|
|
bao write $p
|
|
issuing_certificates={{ OPENBAO_PKI_ISSUING_URL | quote }}
|
|
crl_distribution_points={{ OPENBAO_PKI_CRL_URL | quote }} >/dev/null;
|
|
after=$(bao read -format=json $p | grep -v request_id);
|
|
[ "$before" = "$after" ] || echo OPENBAO_CHANGED'
|
|
register: openbao_pki_urls
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_pki_urls.stdout"
|
|
|
|
- name: "📇 Configure the issuing role '{{ OPENBAO_PKI_ISSUING_ROLE }}'"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'set -e;
|
|
p={{ OPENBAO_PKI_MOUNT }}/roles/{{ OPENBAO_PKI_ISSUING_ROLE }};
|
|
before=$(bao read -format=json $p 2>/dev/null | grep -v request_id || true);
|
|
bao write $p
|
|
allowed_domains={{ DOMAIN_PRIMARY | quote }}
|
|
allow_subdomains=true
|
|
allow_bare_domains=true
|
|
max_ttl=2160h
|
|
ttl=720h >/dev/null;
|
|
after=$(bao read -format=json $p | grep -v request_id);
|
|
[ "$before" = "$after" ] || echo OPENBAO_CHANGED'
|
|
register: openbao_pki_role
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_pki_role.stdout"
|