From 8ab24a10ac669ade61761d37e68207b402bc277c Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sun, 6 Jun 2021 14:57:25 +0200
Subject: prometheus: move CA to seperate role and add prometheus zone groups

---
 roles/monitoring/prometheus/server/tasks/tls.yml | 55 ++++--------------------
 1 file changed, 9 insertions(+), 46 deletions(-)

(limited to 'roles/monitoring/prometheus/server/tasks')

diff --git a/roles/monitoring/prometheus/server/tasks/tls.yml b/roles/monitoring/prometheus/server/tasks/tls.yml
index f9ad5ca3..5c112e12 100644
--- a/roles/monitoring/prometheus/server/tasks/tls.yml
+++ b/roles/monitoring/prometheus/server/tasks/tls.yml
@@ -9,14 +9,6 @@
     path: /etc/ssl/prometheus
     state: directory
 
-- name: create CA directory
-  file:
-    path: /etc/ssl/prometheus/ca
-    state: directory
-    owner: root
-    group: root
-    mode: 0700
-
 - name: create server cert/key directory
   file:
     path: /etc/ssl/prometheus/server
@@ -25,42 +17,7 @@
     group: prometheus
     mode: 0750
 
-- name: create CA private key
-  openssl_privatekey:
-    path: /etc/ssl/prometheus/ca/key.pem
-    type: RSA
-    size: 4096
-    owner: root
-    group: root
-    mode: 0600
-
-- name: create signing request for CA certificate
-  openssl_csr:
-    path: /etc/ssl/prometheus/ca/csr.pem
-    privatekey_path: /etc/ssl/prometheus/ca/key.pem
-    CN: "prometheus CA"
-    useCommonNameForSAN: no
-    key_usage:
-    - cRLSign
-    - digitalSignature
-    - keyCertSign
-    key_usage_critical: yes
-    basic_constraints:
-    - 'CA:TRUE'
-    - 'pathlen:0'
-    basic_constraints_critical: yes
-
-- name: create self-signed CA certificate
-  openssl_certificate:
-    path: /etc/ssl/prometheus/ca-crt.pem
-    csr_path: /etc/ssl/prometheus/ca/csr.pem
-    privatekey_path: /etc/ssl/prometheus/ca/key.pem
-    provider: selfsigned
-    selfsigned_digest: sha256
-    selfsigned_not_after: "+18250d" ## 50 years
-
-
-- name: create server private key to connect to exporter
+- name: create private key to connect to exporter
   openssl_privatekey:
     path: /etc/ssl/prometheus/server/exporter-key.pem
     type: RSA
@@ -68,8 +25,9 @@
     owner: prometheus
     group: prometheus
     mode: 0400
+  notify: reload prometheus
 
-- name: create signing request for server certificate to connect to exporter
+- name: create signing request for client certificate to connect to exporter
   openssl_csr:
     path: /etc/ssl/prometheus/server/exporter-csr.pem
     privatekey_path: /etc/ssl/prometheus/server/exporter-key.pem
@@ -87,7 +45,9 @@
     - 'CA:FALSE'
     basic_constraints_critical: yes
 
-- name: create server certificate to connect to exporter
+## TODO: implement remote signing?
+
+- name: create client certificate to connect to exporter
   openssl_certificate:
     path: /etc/ssl/prometheus/server/exporter-crt.pem
     csr_path: /etc/ssl/prometheus/server/exporter-csr.pem
@@ -96,3 +56,6 @@
     ownca_privatekey_path: /etc/ssl/prometheus/ca/key.pem
     ownca_digest: sha256
     ownca_not_after: "+18250d" ## 50 years
+  notify: reload prometheus
+
+## TODO: install /etc/ssl/prometheus/ca-crt.pem from server
-- 
cgit v1.2.3