apps/whawty/auth: almost done

4 files changed, 120 insertions, 58 deletions

diff --git a/roles/apps/whawty/auth/defaults/main.yml b/roles/apps/whawty/auth/defaults/main.yml
new file mode 100644
index 00000000..a7f2dea8
--- /dev/null
+++ b/roles/apps/whawty/auth/defaults/main.yml
@@ -0,0 +1,26 @@
+---
+# whawty_auth_instances:
+#   test:
+#     version: 0.2-rc9
+#     port: 3080
+#     store:
+#       default: 1
+#       params:
+#       - id: 1
+#         argon2id:
+#           time: 1
+#           memory: 65536
+#           threads: 4
+#           length: 32
+#     sync:
+#       port: 3022
+#       authorized_keys:
+#       - ssh-ed25519 ...
+#     storage:
+#       type: ...
+#     publish:
+#       zone: "{{ apps_publish_zone__foo }}"
+#       hostnames:
+#       - passwd.example.com
+#       tls:
+#         certificate_provider: ...
diff --git a/roles/apps/whawty/auth/instance/tasks/main.yml b/roles/apps/whawty/auth/instance/tasks/main.yml
index a5872839..1e2f6c0d 100644
--- a/roles/apps/whawty/auth/instance/tasks/main.yml
+++ b/roles/apps/whawty/auth/instance/tasks/main.yml
@@ -1,10 +1,12 @@
 ---
-## TODO: add storage handling!
-- set_fact:
-    whawty_auth_instance_basepath: "/srv/whawty/{{ whawty_auth_instance }}"
-##
+- name: prepare storage volume
+  vars:
+    storage_volume: "{{ whawty_auth_instances[whawty_auth_instance].storage }}"
+  include_role:
+    name: "storage/{{ whawty_auth_instances[whawty_auth_instance].storage.type }}/volume"
 
-## TODO: custom user
+- set_fact:
+    whawty_auth_instance_basepath: "{{ storage_volume_mountpoint }}"
 
 - name: create instance config directory
   file:
@@ -25,47 +27,47 @@
     mode: 0400
     owner: app
 
-- name: set up tls config
-  when: "'tls' in whawty_auth_instances[whawty_auth_instance]"
-  block:
-  - name: create tls directory
-    file:
-      path: "{{ whawty_auth_instance_basepath }}/config/tls"
-      state: directory
-      mode: 0500
-      owner: app
+- name: create instance tls directory
+  file:
+    path: "{{ whawty_auth_instance_basepath }}/tls"
+    state: directory
+    owner: app
+    mode: 0500
 
-  - name: generate/install/fetch TLS certificate
-    vars:
-      x509_certificate_name: "whawty-auth-{{ whawty_auth_instance }}"
-      x509_certificate_hostnames: "{{ whawty_auth_instances[whawty_auth_instance].hostnames }}"
-      x509_certificate_renewal:
-        install:
-        - dest: "{{ whawty_auth_instance_basepath }}/config/tls/cert.pem"
-          src:
-          - fullchain
-          mode: "0400"
-          owner: app
-        - dest: "{{ whawty_auth_instance_basepath }}/config/tls/key.pem"
-          src:
-          - key
-          mode: "0400"
-          owner: app
-        reload: |
-          pod_id=$(crictl pods -q --state ready --name "^whawty-auth-{{ whawty_auth_instance }}-{{ ansible_nodename }}$")
-          [ -n "$pod_id" ] || exit 0
-          container_id=$(crictl ps -q --name '^app$' -p "$pod_id")
-          [ -n "$container_id" ] || exit 0
-          crictl stop "$container_id"
-    include_role:
-      name: "x509/{{ whawty_auth_instances[whawty_auth_instance].tls.certificate_provider }}/cert"
+- name: generate/install TLS certificates for publishment
+  vars:
+    x509_certificate_name: "whawty-auth-{{ whawty_auth_instance }}_publish"
+    x509_certificate_hostnames: []
+    x509_certificate_config:
+      ca: "{{ whawty_auth_instances[whawty_auth_instance].publish.zone.certificate_ca_config }}"
+      cert:
+        common_name: "whawty-auth-{{ whawty_auth_instance }}"
+        extended_key_usage:
+        - serverAuth
+        extended_key_usage_critical: yes
+        create_subject_key_identifier: yes
+        not_after: +100w
+    x509_certificate_renewal:
+      install:
+      - dest: "{{ whawty_auth_instance_basepath }}/tls/publish-crt.pem"
+        src:
+        - fullchain
+        owner: app
+        mode: "0444"
+      - dest: "{{ whawty_auth_instance_basepath }}/tls/publish-key.pem"
+        src:
+        - key
+        owner: app
+        mode: "0400"
+  include_role:
+    name: "x509/{{ whawty_auth_instances[whawty_auth_instance].publish.zone.certificate_provider }}/cert"
 
-  - name: generate app web config
-    template:
-      src: web.yml.j2
-      dest: "{{ whawty_auth_instance_basepath }}/config/web.yml"
-      mode: 0400
-      owner: app
+- name: generate app web config
+  template:
+    src: web.yml.j2
+    dest: "{{ whawty_auth_instance_basepath }}/config/web.yml"
+    mode: 0400
+    owner: app
 
 - name: set up sync config
   when: "'sync' in whawty_auth_instances[whawty_auth_instance]"
@@ -104,9 +106,7 @@
   vars:
     whawty_auth_instance_config_hash_items__yaml: |
       - path: "{{ whawty_auth_instance_basepath }}/config/store.yml"
-      {% if 'tls' in whawty_auth_instances[whawty_auth_instance] %}
       - path: "{{ whawty_auth_instance_basepath }}/config/web.yml"
-      {% endif %}
       {% if 'sync' in whawty_auth_instances[whawty_auth_instance] %}
       - path: "{{ whawty_auth_instance_basepath }}/sync/authorized_keys"
       - path: "{{ whawty_auth_instance_basepath }}/sync/group"
@@ -121,3 +121,38 @@
       config_hash_items: "{{ whawty_auth_instance_config_hash_items__yaml | from_yaml }}"
   include_role:
     name: kubernetes/standalone/pod
+
+- name: configure nginx vhost for publishment
+  vars:
+    nginx_vhost__yaml: |
+      {% if whawty_auth_instances[whawty_auth_instance].publish.zone.publisher == inventory_hostname %}
+      name: "whawty-auth-{{ whawty_auth_instance }}"
+      {% else %}
+      name: "whawty-auth-{{ whawty_auth_instance }}-{{ inventory_hostname }}"
+      {% endif %}
+      template: generic
+      {% if 'tls' in whawty_auth_instances[whawty_auth_instance].publish %}
+      tls:
+        {{ whawty_auth_instances[whawty_auth_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }}
+      {% endif %}
+      hostnames:
+      {% for hostname in whawty_auth_instances[whawty_auth_instance].publish.hostnames %}
+      - {{ hostname }}
+      {% endfor %}
+      locations:
+        '/':
+      {% if whawty_auth_instances[whawty_auth_instance].publish.zone.publisher == inventory_hostname %}
+          proxy_pass: "https://127.0.0.1:{{ whawty_auth_instances[whawty_auth_instance].port }}"
+      {% else %}
+          proxy_pass: "https://{{ ansible_default_ipv4.address }}:{{ whawty_auth_instances[whawty_auth_instance].port }}"
+      {% endif %}
+          proxy_ssl:
+            trusted_certificate: "/etc/ssl/apps-publish-{{ whawty_auth_instances[whawty_auth_instance].publish.zone.name }}/apps-publish-{{ whawty_auth_instances[whawty_auth_instance].publish.zone.name }}-ca-crt.pem"
+            verify: "on"
+            name: "whawty-auth-{{ whawty_auth_instance }}"
+            protocols: "TLSv1.3"
+    nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}"
+  include_role:
+    name: nginx/vhost
+    apply:
+      delegate_to: "{{ whawty_auth_instances[whawty_auth_instance].publish.zone.publisher }}"
diff --git a/roles/apps/whawty/auth/instance/templates/pod-spec.yml.j2 b/roles/apps/whawty/auth/instance/templates/pod-spec.yml.j2
index b264577d..50f8e0c2 100644
--- a/roles/apps/whawty/auth/instance/templates/pod-spec.yml.j2
+++ b/roles/apps/whawty/auth/instance/templates/pod-spec.yml.j2
@@ -11,14 +11,15 @@ containers:
   - "run"
   - "--web-addr"
   - ":{{ whawty_auth_instances[whawty_auth_instance].port }}"
-{% if 'tls' in whawty_auth_instances[whawty_auth_instance] %}
   - "--web-config"
   - "/config/web.yml"
-{% endif %}
   volumeMounts:
   - name: config
     mountPath: /config
     readOnly: true
+  - name: tls
+    mountPath: /tls
+    readOnly: true
   - name: store
     mountPath: /store
   env:
@@ -28,6 +29,9 @@ containers:
   ports:
   - containerPort: {{ whawty_auth_instances[whawty_auth_instance].port }}
     hostPort: {{ whawty_auth_instances[whawty_auth_instance].port }}
+{% if whawty_auth_instances[whawty_auth_instance].publish.zone.publisher == inventory_hostname %}
+    hostIP: "127.0.0.1"
+{% endif %}
 {% if 'sync' in whawty_auth_instances[whawty_auth_instance] %}
 - name: sync
   image: "ghcr.io/whawty/auth/sync:v{{ whawty_auth_instances[whawty_auth_instance].version }}"
@@ -49,6 +53,10 @@ volumes:
   hostPath:
     path: "{{ whawty_auth_instance_basepath }}/config"
     type: Directory
+- name: tls
+  hostPath:
+    path: "{{ whawty_auth_instance_basepath }}/tls"
+    type: Directory
 - name: store
   hostPath:
     path: "{{ whawty_auth_instance_basepath }}/store"
diff --git a/roles/apps/whawty/auth/instance/templates/web.yml.j2 b/roles/apps/whawty/auth/instance/templates/web.yml.j2
index 705e056d..d7f35f2e 100644
--- a/roles/apps/whawty/auth/instance/templates/web.yml.j2
+++ b/roles/apps/whawty/auth/instance/templates/web.yml.j2
@@ -1,13 +1,6 @@
 ---
 tls:
-  certificate: /config/tls/cert.pem
-  certificate-key: /config/tls/key.pem
-  min-protocol-version: "TLSv1.2"
-  ciphers:
-  - ECDHE_RSA_WITH_AES_128_GCM_SHA256
-  - ECDHE_RSA_WITH_AES_256_GCM_SHA384
-  - ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-  - TLS_AES_128_GCM_SHA256
-  - TLS_AES_256_GCM_SHA384
-  - TLS_CHACHA20_POLY1305_SHA256
+  certificate: /tls/publish-crt.pem
+  certificate-key: /tls/publish-key.pem
+  min-protocol-version: "TLSv1.3"
   prefer-server-ciphers: true