10 files changed, 94 insertions, 30 deletions

diff --git a/chaos-at-home/ch-testvm-phoebe.yml b/chaos-at-home/ch-testvm-phoebe.yml
index 29b260c0..ee1145f5 100644
--- a/chaos-at-home/ch-testvm-phoebe.yml
+++ b/chaos-at-home/ch-testvm-phoebe.yml
@@ -11,6 +11,5 @@
 - name: Payload Setup
   hosts: ch-testvm-phoebe
   roles:
-  - role: apt-repo/spreadspace
-  - role: nginx/base
-  - role: monitoring/prometheus/exporter
+  - role: x509/managed-ca/base
+  - role: mosquitto/client
diff --git a/chaos-at-home/ch-testvm-prometheus.yml b/chaos-at-home/ch-testvm-prometheus.yml
index 0be8e001..aaae91d1 100644
--- a/chaos-at-home/ch-testvm-prometheus.yml
+++ b/chaos-at-home/ch-testvm-prometheus.yml
@@ -13,4 +13,4 @@
   roles:
   - role: x509/managed-ca/base
   - role: x509/managed-ca/ca
-  - role: mosquitto
+  - role: mosquitto/broker
diff --git a/inventory/host_vars/ch-testvm-phoebe.yml b/inventory/host_vars/ch-testvm-phoebe.yml
index d15e4142..7eae49e7 100644
--- a/inventory/host_vars/ch-testvm-phoebe.yml
+++ b/inventory/host_vars/ch-testvm-phoebe.yml
@@ -39,3 +39,41 @@ network:
     address: "{{ network_zones.iot.prefix | ansible.utils.ipaddr(network_zones.iot.offsets[inventory_hostname]) }}"
 
 ntp_variant: systemd-timesyncd
+
+
+###
+mosquitto_client_tls:
+  foo-consumer:
+    certificate_provider: managed-ca
+    certificate_config:
+      ca:
+        host: ch-testvm-prometheus
+        name: foo
+      cert:
+        common_name: consumer
+        organization_name: "spreadspace"
+        organizational_unit_name: "ansible"
+        san_extra:
+        - "IP:192.168.32.43"
+        extended_key_usage:
+        - clientAuth
+        extended_key_usage_critical: yes
+        create_subject_key_identifier: yes
+        not_after: +100w
+  foo-producer:
+    certificate_provider: managed-ca
+    certificate_config:
+      ca:
+        host: ch-testvm-prometheus
+        name: foo
+      cert:
+        common_name: producer
+        organization_name: "spreadspace"
+        organizational_unit_name: "ansible"
+        san_extra:
+        - "IP:192.168.32.43"
+        extended_key_usage:
+        - clientAuth
+        extended_key_usage_critical: yes
+        create_subject_key_identifier: yes
+        not_after: +100w
diff --git a/inventory/host_vars/ch-testvm-prometheus.yml b/inventory/host_vars/ch-testvm-prometheus.yml
index de31921f..ff36f733 100644
--- a/inventory/host_vars/ch-testvm-prometheus.yml
+++ b/inventory/host_vars/ch-testvm-prometheus.yml
@@ -55,11 +55,17 @@ managed_ca_authorities:
       not_after: +520w
 
 
-mosquitto_global_config_options:
+mosquitto_broker_global_config_options:
   per_listener_settings: "true"
 
-mosquitto_listeners:
+mosquitto_broker_listeners:
   example:
+    bind: 1883
+    options:
+      allow_anonymous: "false"
+      acl_file: /etc/mosquitto/example.acl
+      password_file: /etc/mosquitto/example.passwd
+  foo:
     bind: 1884 192.168.32.42
     hostnames:
     - mqtt.example.com
@@ -74,22 +80,21 @@ mosquitto_listeners:
           organizational_unit_name: "ansible"
           san_extra:
           - "IP:192.168.32.42"
+          extended_key_usage:
+          - serverAuth
+          extended_key_usage_critical: yes
           create_subject_key_identifier: yes
           not_after: +100w
     options:
-      allow_anonymous: "true"
+      allow_anonymous: "false"
       require_certificate: "true"
+      cafile: /etc/mosquitto/ca_certificates/foo-ca-crt.pem
+      use_identity_as_username: "true"
       acl_file: /etc/mosquitto/foo.acl
-  foo:
-    bind: 1883
-    options:
-      allow_anonymous: "false"
-      acl_file: /etc/mosquitto/example.acl
-      password_file: /etc/mosquitto/example.passwd
 
-mosquitto_prometheus_listener: true
+mosquitto_broker_prometheus_listener: true
 
-mosquitto_acl_files:
+mosquitto_broker_acl_files:
   example: |
     user admin
     topic read test/+
@@ -101,7 +106,7 @@ mosquitto_acl_files:
     user producer
     topic write foo/+
 
-mosquitto_password_files:
+mosquitto_broker_password_files:
   example: |
     admin:{{ 'admin' | mosquitto_passwd_hash('admin@mqtt.example.com') }}
     equinox:{{ 'secret' | mosquitto_passwd_hash('equinox@mqtt.example.com') }}
diff --git a/roles/mosquitto/defaults/main.yml b/roles/mosquitto/broker/defaults/main.yml
index 32199a50..bd509f9c 100644
--- a/roles/mosquitto/defaults/main.yml
+++ b/roles/mosquitto/broker/defaults/main.yml
@@ -1,8 +1,8 @@
 ---
-# mosquitto_global_config_options:
+# mosquitto_broker_global_config_options:
 #   per_listener_settings: "true"
 
-mosquitto_listeners: {}
+mosquitto_broker_listeners: {}
 #   example:
 #     bind: 1883 192.0.2.1
 #     hostnames:
@@ -19,13 +19,13 @@ mosquitto_listeners: {}
 #       acl_file: /etc/mosquitto/example.acl
 #       password_file: /etc/mosquitto/example.passwd
 
-mosquitto_prometheus_listener: false
+mosquitto_broker_prometheus_listener: false
 
-mosquitto_acl_files: {}
+mosquitto_broker_acl_files: {}
 #   example: |
 #     user somebody
 #     topic read example/+/foo
 
-mosquitto_password_files: {}
+mosquitto_broker_password_files: {}
 #   example: |
 #     somebody:{{ 'secret' | mosquitto_passwd_hash('somebody@mqtt.example.com') }}
diff --git a/roles/mosquitto/handlers/main.yml b/roles/mosquitto/broker/handlers/main.yml
index c188764d..c188764d 100644
--- a/roles/mosquitto/handlers/main.yml
+++ b/roles/mosquitto/broker/handlers/main.yml
diff --git a/roles/mosquitto/tasks/main.yml b/roles/mosquitto/broker/tasks/main.yml
index 41b7dc7a..3afffd71 100644
--- a/roles/mosquitto/tasks/main.yml
+++ b/roles/mosquitto/broker/tasks/main.yml
@@ -7,7 +7,7 @@
     state: present
 
 - name: install mosquitto acl files
-  loop: "{{ mosquitto_acl_files | dict2items }}"
+  loop: "{{ mosquitto_broker_acl_files | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
   copy:
@@ -18,7 +18,7 @@
   notify: reload mosquitto
 
 - name: install mosquitto password files
-  loop: "{{ mosquitto_password_files | dict2items }}"
+  loop: "{{ mosquitto_broker_password_files | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
   copy:
@@ -31,18 +31,18 @@
   notify: reload mosquitto
 
 - name: generate Diffie-Hellman parameters
-  when: (mosquitto_listeners | dict2items | selectattr('value.tls', 'defined') | length) > 0
+  when: (mosquitto_broker_listeners | dict2items | selectattr('value.tls', 'defined') | length) > 0
   openssl_dhparam:
     path: /etc/mosquitto/certs/dhparams.pem
     size: 2048
   notify: reload mosquitto
 
 - name: generate/install/fetch TLS certificate
-  loop: "{{ mosquitto_listeners | dict2items | selectattr('value.tls', 'defined') }}"
+  loop: "{{ mosquitto_broker_listeners | dict2items | selectattr('value.tls', 'defined') }}"
   loop_control:
     label: "{{ item.key }}"
   vars:
-    x509_certificate_name: "mosquitto-{{ item.key }}"
+    x509_certificate_name: "mosquitto-broker-{{ item.key }}"
     x509_certificate_hostnames: "{{ item.value.hostnames }}"
     x509_certificate_config: "{{ item.value.tls.certificate_config | default({}) }}"
     x509_certificate_renewal:
diff --git a/roles/mosquitto/templates/config.j2 b/roles/mosquitto/broker/templates/config.j2
index e6fa4b52..e042ac25 100644
--- a/roles/mosquitto/templates/config.j2
+++ b/roles/mosquitto/broker/templates/config.j2
@@ -1,12 +1,12 @@
 # {{ ansible_managed }}
 
 ## Global
-{% if mosquitto_global_config_options is defined %}
-{%   for option, value in mosquitto_global_config_options.items() %}
+{% if mosquitto_broker_global_config_options is defined %}
+{%   for option, value in mosquitto_broker_global_config_options.items() %}
 {{ option }} {{ value }}
 {%   endfor %}
 {% endif %}
-{% for name, listener in mosquitto_listeners.items() %}
+{% for name, listener in mosquitto_broker_listeners.items() %}
 
 ## Listener: {{ name }}
 listener {{ listener.bind }}
@@ -21,7 +21,7 @@ dhparamfile /etc/mosquitto/certs/dhparams.pem
 {%     endfor %}
 {%   endif %}
 {% endfor %}
-{% if mosquitto_prometheus_listener %}
+{% if mosquitto_broker_prometheus_listener %}
 
 ## Prometheus monitoring
 listener 0 /var/run/mosquitto/prometheus.sock
diff --git a/roles/mosquitto/client/defaults/main.yml b/roles/mosquitto/client/defaults/main.yml
new file mode 100644
index 00000000..7485601a
--- /dev/null
+++ b/roles/mosquitto/client/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+mosquitto_client_tls: {}
+#   example:
+#     certificate_provider: ...
+#     certificate_config: ...
diff --git a/roles/mosquitto/client/tasks/main.yml b/roles/mosquitto/client/tasks/main.yml
new file mode 100644
index 00000000..f7463e2a
--- /dev/null
+++ b/roles/mosquitto/client/tasks/main.yml
@@ -0,0 +1,17 @@
+---
+- name: install mosquitto
+  apt:
+    name:
+    - mosquitto-clients
+    state: present
+
+- name: generate/install/fetch TLS certificate
+  loop: "{{ mosquitto_client_tls | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  vars:
+    x509_certificate_name: "mosquitto-client-{{ item.key }}"
+    x509_certificate_hostnames: []
+    x509_certificate_config: "{{ item.value.certificate_config }}"
+  include_role:
+    name: "x509/{{ item.value.certificate_provider }}/cert"