From 7c296e7021ee3371bc7fc87655487256774fc855 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sun, 4 Apr 2021 00:10:55 +0200
Subject: move cryptdisk role to new storage subdir

---
 roles/storage/luks/volumes/defaults/main.yml |  8 ++++++
 roles/storage/luks/volumes/tasks/main.yml    | 43 ++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 roles/storage/luks/volumes/defaults/main.yml
 create mode 100644 roles/storage/luks/volumes/tasks/main.yml

(limited to 'roles/storage')

diff --git a/roles/storage/luks/volumes/defaults/main.yml b/roles/storage/luks/volumes/defaults/main.yml
new file mode 100644
index 00000000..2347231c
--- /dev/null
+++ b/roles/storage/luks/volumes/defaults/main.yml
@@ -0,0 +1,8 @@
+---
+# luks_volumes:
+#   crypto-nvme0:
+#     passphrase: "keep-this-very-very-secret"
+#     device: /dev/nvme0n1p3
+#   crypto-nvme1:
+#     passphrase: "use-differnt-passphrase-and-keep-this-secret-as-well"
+#     device: /dev/nvme1n1p3
diff --git a/roles/storage/luks/volumes/tasks/main.yml b/roles/storage/luks/volumes/tasks/main.yml
new file mode 100644
index 00000000..8fdb3019
--- /dev/null
+++ b/roles/storage/luks/volumes/tasks/main.yml
@@ -0,0 +1,43 @@
+---
+- name: install cryptsetup packages
+  apt:
+    name: cryptsetup-bin
+    state: present
+
+- name: Create temporary build directory
+  tempfile:
+    state: directory
+  register: keyfile_dir
+  changed_when: False
+  check_mode: False
+
+- name: create luks volumes
+  block:
+  - name: write passphrases into temporary keyfiles
+    loop: "{{ luks_volumes | dict2items }}"
+    loop_control:
+      label: "{{ item.key }}"
+    copy:
+      dest: "{{ keyfile_dir.path }}/{{ item.key }}"
+      content: "{{ item.value.passphrase }}"
+      mode: 0600
+    changed_when: False
+    check_mode: False
+
+  - name: create/open luks volumes
+    loop: "{{ luks_volumes | dict2items }}"
+    loop_control:
+      label: "{{ item.key }} ({{ item.value.device }})"
+    luks_device:
+      name: "{{ item.key }}"
+      device: "{{ item.value.device }}"
+      keyfile: "{{ keyfile_dir.path }}/{{ item.key }}"
+      state: opened
+
+  always:
+  - name: remove base-directory for keyfiles
+    file:
+      path: "{{ keyfile_dir.path }}"
+      state: absent
+    changed_when: False
+    check_mode: False
-- 
cgit v1.2.3