apps/coturn: move to new generic certificate roles

6 files changed, 57 insertions, 71 deletions

diff --git a/dan/sk-testvm.yml b/dan/sk-testvm.yml
index 1d047447..13a0b499 100644
--- a/dan/sk-testvm.yml
+++ b/dan/sk-testvm.yml
@@ -56,21 +56,32 @@
   #         index: index.html
   #   static_cert_config: "{{ static_cert_config__test }}"
   #   selfsigned_cert_config: "{{ selfsigned_cert_config__test }}"
-  - role: apps/mumble
-    mumble_version: v1.4.274-4
-    mumble_instance: spreadspace
-    mumble_hostnames:
+  # - role: apps/mumble
+  #   mumble_version: v1.4.274-4
+  #   mumble_instance: spreadspace
+  #   mumble_hostnames:
+  #   - test.spreadspace.org
+  #   - test.spreadspace.com
+  #   - test.spreadspace.net
+  #   - test.spreadspace.systems
+  #   mumble_superuser_password: "very-secret"
+  #   mumble_config_options:
+  #     bonjour: false
+  #     sslCiphers: "ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES256:DHE+AES256:ECDHE+AES128:DHE+AES128:!RSA:!ADH:!AECDH:!MD5"
+  #     welcometext: "Welcome to the spreadspace Mumble Test-Server"
+  #     rememberchannel: true
+  #   mumble_tls:
+  #     certificate_provider: "{{ cert_provider }}"
+  - role: apps/coturn
+    coturn_version: 4.6.2-r4
+    coturn_realm: spreadspace
+    coturn_hostnames:
     - test.spreadspace.org
     - test.spreadspace.com
     - test.spreadspace.net
     - test.spreadspace.systems
-    mumble_superuser_password: "very-secret"
-    mumble_config_options:
-      bonjour: false
-      sslCiphers: "ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES256:DHE+AES256:ECDHE+AES128:DHE+AES128:!RSA:!ADH:!AECDH:!MD5"
-      welcometext: "Welcome to the spreadspace Mumble Test-Server"
-      rememberchannel: true
-    mumble_tls:
+    coturn_auth_secret: "somewhat-secret"
+    coturn_tls:
       certificate_provider: "{{ cert_provider }}"
   post_tasks:
   - name: make sure document root directories exist
diff --git a/inventory/host_vars/sk-testvm.yml b/inventory/host_vars/sk-testvm.yml
index f5dca015..a09d8de5 100644
--- a/inventory/host_vars/sk-testvm.yml
+++ b/inventory/host_vars/sk-testvm.yml
@@ -59,6 +59,7 @@ kubernetes_version: 1.27.4
 kubernetes_cri_tools_pkg_version: 1.26.0-00
 kubernetes_container_runtime: docker
 kubernetes_standalone_max_pods: 100
+kubernetes_standalone_pod_cidr: 192.168.255.0/24
 kubernetes_standalone_cni_variant: with-portmap
 
 
diff --git a/roles/apps/coturn/defaults/main.yml b/roles/apps/coturn/defaults/main.yml
index 842e7f05..709d3d07 100644
--- a/roles/apps/coturn/defaults/main.yml
+++ b/roles/apps/coturn/defaults/main.yml
@@ -17,6 +17,9 @@ coturn_threads: 0
 
 coturn_dhparam_size: 2048
 
+# coturn_tls:
+#   certificate_provider: ...
+
 coturn_listening_port: 3478
 coturn_tls_listening_port: 5349
 
diff --git a/roles/apps/coturn/tasks/main.yml b/roles/apps/coturn/tasks/main.yml
index ed0c06ab..4e5adbd5 100644
--- a/roles/apps/coturn/tasks/main.yml
+++ b/roles/apps/coturn/tasks/main.yml
@@ -1,10 +1,4 @@
 ---
-- name: check if acme_client is set to acmetool
-  assert:
-    msg: "this role currently only works with acmetool"
-    that:
-    - acme_client == "acmetool"
-
 - name: add group for coturn
   group:
     name: coturn
@@ -45,24 +39,28 @@
     group: coturn
     mode: 0644
 
-- name: install acmetool hook script
-  template:
-    src: acmetool-reload.sh.j2
-    dest: "/etc/acme/hooks/coturn-{{ coturn_realm }}"
-    mode: 0755
-
-- name: install acmetool systemd unit snippet
-  copy:
-    dest: "/etc/systemd/system/acmetool.service.d/coturn-{{ coturn_realm }}.conf"
-    content: |
-      [Service]
-      ReadWritePaths={{ coturn_base_path }}/{{ coturn_realm }}/config/ssl
-  register: coturn_acmetool_snippet
-
-- name: reload systemd
-  when: coturn_acmetool_snippet is changed
-  systemd:
-    daemon_reload: yes
+- name: compute certificate renewal config
+  set_fact:
+    coturn_certificate_renewal:
+      install:
+      - dest: "{{ coturn_base_path }}/{{ coturn_realm }}/config/ssl/cert.pem"
+        src:
+        - fullchain
+        owner: root
+        group: coturn
+        mode: "0644"
+      - dest: "{{ coturn_base_path }}/{{ coturn_realm }}/config/ssl/privkey.pem"
+        src:
+        - key
+        owner: root
+        group: coturn
+        mode: "0640"
+      reload: |
+        pod_id=$(crictl pods -q --state ready --name "^coturn-{{ coturn_realm }}-{{ ansible_nodename }}$")
+        [ -n "$pod_id" ] || exit 42
+        container_id=$(crictl ps -q --name '^coturn$' -p "$pod_id")
+        [ -n "$container_id" ] || exit 42
+        crictl stop "$container_id"
 
 - name: configure nginx vhost
   when: coturn_install_nginx_vhost
@@ -70,22 +68,23 @@
     nginx_vhost:
       name: "coturn-{{ coturn_realm }}"
       template: generic
-      tls:
-        certificate_provider: acmetool
+      tls: "{{ coturn_tls }}"
       hostnames: "{{ coturn_hostnames }}"
       locations:
         '/':
           return: "404"
+    x509_certificate_renewal: "{{ coturn_certificate_renewal }}"
   include_role:
     name: nginx/vhost
 
-- name: get certificate using acmetool
+- name: generate/install/fetch TLS certificate
   when: not coturn_install_nginx_vhost
-  import_role:
-    name: x509/acmetool/cert
   vars:
-    acmetool_cert_name: "coturn-{{ coturn_realm }}"
-    acmetool_cert_hostnames: "{{ coturn_hostnames }}"
+    x509_certificate_name: "coturn-{{ coturn_realm }}"
+    x509_certificate_hostnames: "{{ coturn_hostnames }}"
+    x509_certificate_renewal: "{{ coturn_certificate_renewal }}"
+  include_role:
+    name: "x509/{{ coturn_tls.certificate_provider }}/cert"
 
 - name: install pod manifest
   vars:
diff --git a/roles/apps/coturn/templates/acmetool-reload.sh.j2 b/roles/apps/coturn/templates/acmetool-reload.sh.j2
deleted file mode 100644
index 08530583..00000000
--- a/roles/apps/coturn/templates/acmetool-reload.sh.j2
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/sh
-set -e
-EVENT_NAME="$1"
-[ "$EVENT_NAME" = "live-updated" ] || exit 42
-
-MAIN_HOSTNAME="{{ coturn_hostnames[0] }}"
-SSL_D="{{ coturn_base_path }}/{{ coturn_realm }}/config/ssl"
-
-while read name; do
-  certdir="$ACME_STATE_DIR/live/$name"
-  if [ -z "$name" -o ! -e "$certdir" ]; then
-    continue
-  fi
-  if [ "$name" != "$MAIN_HOSTNAME" ]; then
-    continue
-  fi
-
-  install -m 0644 -o root -g coturn "$certdir/fullchain" "$SSL_D/cert.pem"
-  install -m 0640 -o root -g coturn "$certdir/privkey" "$SSL_D/privkey.pem"
-
-  pod_id=$(crictl pods -q --state ready --name "^coturn-{{ coturn_realm }}-{{ ansible_nodename }}$")
-  [ -n "$pod_id" ] || exit 42
-  container_id=$(crictl ps -q --name '^coturn$' -p "$pod_id")
-  [ -n "$container_id" ] || exit 42
-  crictl stop "$container_id"
-
-  break
-done
diff --git a/roles/apps/mumble/tasks/main.yml b/roles/apps/mumble/tasks/main.yml
index b59fb5fc..5b380725 100644
--- a/roles/apps/mumble/tasks/main.yml
+++ b/roles/apps/mumble/tasks/main.yml
@@ -27,7 +27,7 @@
     group: mumble
     mode: 0644
 
-- name: generate/install/fetc TLS certificate
+- name: generate/install/fetch TLS certificate
   vars:
     x509_certificate_name: "mumble-{{ mumble_instance }}"
     x509_certificate_hostnames: "{{ mumble_hostnames }}"