diff options
author | Christian Pointner <equinox@spreadspace.org> | 2023-10-26 13:58:00 +0200 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2023-10-26 13:58:00 +0200 |
commit | def061765aa3f4422472bc08a65bfc3e7f57b3ea (patch) | |
tree | 6b4173aabd89073d921a7a5834a55ee781bd078a /roles/apps/whawty/auth/instance/tasks | |
parent | x509/certs: fix renewal scripts (diff) |
apps/whawty/auth: app no longer runs as root and switch to new sync
Diffstat (limited to 'roles/apps/whawty/auth/instance/tasks')
-rw-r--r-- | roles/apps/whawty/auth/instance/tasks/main.yml | 52 |
1 files changed, 37 insertions, 15 deletions
diff --git a/roles/apps/whawty/auth/instance/tasks/main.yml b/roles/apps/whawty/auth/instance/tasks/main.yml index 2de99efa..a5872839 100644 --- a/roles/apps/whawty/auth/instance/tasks/main.yml +++ b/roles/apps/whawty/auth/instance/tasks/main.yml @@ -6,19 +6,24 @@ ## TODO: custom user -- name: create instance directories - loop: - - config - - store +- name: create instance config directory file: - path: "{{ whawty_auth_instance_basepath }}/{{ item }}" + path: "{{ whawty_auth_instance_basepath }}/config" state: directory +- name: create instance store directory + file: + path: "{{ whawty_auth_instance_basepath }}/store" + state: directory + owner: app + mode: 0700 + - name: generate store config template: src: store.yml.j2 dest: "{{ whawty_auth_instance_basepath }}/config/store.yml" mode: 0400 + owner: app - name: set up tls config when: "'tls' in whawty_auth_instances[whawty_auth_instance]" @@ -27,7 +32,8 @@ file: path: "{{ whawty_auth_instance_basepath }}/config/tls" state: directory - mode: 0400 + mode: 0500 + owner: app - name: generate/install/fetch TLS certificate vars: @@ -39,10 +45,12 @@ src: - fullchain mode: "0400" + owner: app - dest: "{{ whawty_auth_instance_basepath }}/config/tls/key.pem" src: - key mode: "0400" + owner: app reload: | pod_id=$(crictl pods -q --state ready --name "^whawty-auth-{{ whawty_auth_instance }}-{{ ansible_nodename }}$") [ -n "$pod_id" ] || exit 0 @@ -52,24 +60,30 @@ include_role: name: "x509/{{ whawty_auth_instances[whawty_auth_instance].tls.certificate_provider }}/cert" - - name: generate store config + - name: generate app web config template: src: web.yml.j2 dest: "{{ whawty_auth_instance_basepath }}/config/web.yml" mode: 0400 + owner: app - name: set up sync config when: "'sync' in whawty_auth_instances[whawty_auth_instance]" block: - name: create sync directory file: - path: "{{ whawty_auth_instance_basepath }}/sync/gokr-rsyncd" + path: "{{ whawty_auth_instance_basepath }}/sync" state: directory - - name: generate sync config + - name: generate sync config files + loop: + - group + - passwd + - rsyncd.conf + - sshd_config template: - src: sync.toml.j2 - dest: "{{ whawty_auth_instance_basepath }}/sync/config.toml" + src: "sync-{{ item }}.j2" + dest: "{{ whawty_auth_instance_basepath }}/sync/{{ item }}" - name: generate authorized_keys for sync copy: @@ -77,9 +91,14 @@ dest: "{{ whawty_auth_instance_basepath }}/sync/authorized_keys" - name: generate ssh host key for sync - command: "ssh-keygen -q -t ed25519 -f '{{ whawty_auth_instance_basepath }}/sync/gokr-rsyncd/ssh_host_ed25519_key' -C '' -N ''" + command: "ssh-keygen -q -t ed25519 -f '{{ whawty_auth_instance_basepath }}/sync/ssh_host_ed25519_key' -C '' -N ''" args: - creates: "{{ whawty_auth_instance_basepath }}/sync/gokr-rsyncd/ssh_host_ed25519_key" + creates: "{{ whawty_auth_instance_basepath }}/sync/ssh_host_ed25519_key" + + - name: fix permissions for ssh host keys + file: + path: "{{ whawty_auth_instance_basepath }}/sync/ssh_host_ed25519_key" + owner: app - name: install pod manifest vars: @@ -89,9 +108,12 @@ - path: "{{ whawty_auth_instance_basepath }}/config/web.yml" {% endif %} {% if 'sync' in whawty_auth_instances[whawty_auth_instance] %} - - path: "{{ whawty_auth_instance_basepath }}/sync/config.toml" - path: "{{ whawty_auth_instance_basepath }}/sync/authorized_keys" - - path: "{{ whawty_auth_instance_basepath }}/sync/gokr-rsyncd/ssh_host_ed25519_key" + - path: "{{ whawty_auth_instance_basepath }}/sync/group" + - path: "{{ whawty_auth_instance_basepath }}/sync/passwd" + - path: "{{ whawty_auth_instance_basepath }}/sync/rsyncd.conf" + - path: "{{ whawty_auth_instance_basepath }}/sync/ssh_host_ed25519_key" + - path: "{{ whawty_auth_instance_basepath }}/sync/sshd_config" {% endif %} kubernetes_standalone_pod: name: "whawty-auth-{{ whawty_auth_instance }}" |