diff options
| author | Christian Pointner <equinox@spreadspace.org> | 2021-07-25 11:24:47 +0200 |
|---|---|---|
| committer | Christian Pointner <equinox@spreadspace.org> | 2021-07-25 11:24:47 +0200 |
| commit | 83a9137a8450f5e8ec1ae828b3e3e3554b76b013 (patch) | |
| tree | 701077b59e758fd9145f068e9f66dcf088ee62fd /roles/monitoring/prometheus/ca | |
| parent | ele-router: preapare setup for e21 (diff) | |
| parent | promethues exporter: add TODO list (diff) | |
Merge branch 'topic/prometheus'
Diffstat (limited to 'roles/monitoring/prometheus/ca')
| -rw-r--r-- | roles/monitoring/prometheus/ca/tasks/main.yml | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/roles/monitoring/prometheus/ca/tasks/main.yml b/roles/monitoring/prometheus/ca/tasks/main.yml new file mode 100644 index 00000000..064cb6e8 --- /dev/null +++ b/roles/monitoring/prometheus/ca/tasks/main.yml @@ -0,0 +1,52 @@ +--- +- name: install python-cryptoraphy + apt: + name: "{{ python_basename }}-cryptography" + state: present + +- name: create base directory + file: + path: /etc/ssl/prometheus + state: directory + +- name: create CA directory + file: + path: /etc/ssl/prometheus/ca + state: directory + owner: root + group: root + mode: 0700 + +- name: create CA private key + openssl_privatekey: + path: /etc/ssl/prometheus/ca/key.pem + type: RSA + size: 4096 + owner: root + group: root + mode: 0600 + +- name: create signing request for CA certificate + openssl_csr: + path: /etc/ssl/prometheus/ca/csr.pem + privatekey_path: /etc/ssl/prometheus/ca/key.pem + CN: "CA for prometheus zone {{ prometheus_zone_name }}" + useCommonNameForSAN: no + key_usage: + - cRLSign + - keyCertSign + key_usage_critical: yes + basic_constraints: + - 'CA:TRUE' + - 'pathlen:0' + basic_constraints_critical: yes + +- name: create self-signed CA certificate + openssl_certificate: + path: /etc/ssl/prometheus/ca-crt.pem + csr_path: /etc/ssl/prometheus/ca/csr.pem + privatekey_path: /etc/ssl/prometheus/ca/key.pem + provider: selfsigned + selfsigned_digest: sha256 + selfsigned_not_after: "+18250d" ## 50 years + selfsigned_create_subject_key_identifier: always_create |