From 24b4917d8186551bcf987b72d1c3588e4705096a Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sun, 28 Jan 2024 02:11:05 +0100 Subject: finalize whawty/auth roles for now --- roles/whawty/auth/store/defaults/main.yml | 52 +++++++++++----------- roles/whawty/auth/store/tasks/main.yml | 37 ++++++++++----- roles/whawty/auth/store/tasks/sync-client.yml | 49 +++++++++----------- .../whawty/auth/store/templates/systemd.service.j2 | 6 +-- 4 files changed, 77 insertions(+), 67 deletions(-) (limited to 'roles/whawty/auth/store') diff --git a/roles/whawty/auth/store/defaults/main.yml b/roles/whawty/auth/store/defaults/main.yml index b8cb08b7..c479c600 100644 --- a/roles/whawty/auth/store/defaults/main.yml +++ b/roles/whawty/auth/store/defaults/main.yml @@ -1,27 +1,27 @@ --- -# whawty_auth_store: -# name: foo -# config: -# basedir: "/var/lib/whawty/auth/foo" -# default: 2 -# params: -# - id: 1 -# scryptauth: -# hmackey: "<32bytes random secret data base64-encoded>" -# cost: 12 -# - id: 2 -# argon2id: -# time: 1 -# memory: 65536 ## 64 MB -# threads: 4 -# length: 32 -# permissions: -# owner: root -# group: foo -# file-mode: "0640" -# dir-mode: "0750" -# sync: -# type: client -# hostname: passwd.example.com -# port: 3022 -# user: sync +# whawty_auth_store_instances: +# foo: +# config: +# basedir: "/var/lib/whawty/auth/foo" +# default: 2 +# params: +# - id: 1 +# scryptauth: +# hmackey: "<32bytes random secret data base64-encoded>" +# cost: 12 +# - id: 2 +# argon2id: +# time: 1 +# memory: 65536 ## 64 MB +# threads: 4 +# length: 32 +# permissions: +# owner: root +# group: foo +# file-mode: "0640" +# dir-mode: "0750" +# sync: +# type: client +# hostname: passwd.example.com +# port: 3022 +# user: sync diff --git a/roles/whawty/auth/store/tasks/main.yml b/roles/whawty/auth/store/tasks/main.yml index 86f2691b..9a0ea26b 100644 --- a/roles/whawty/auth/store/tasks/main.yml +++ b/roles/whawty/auth/store/tasks/main.yml @@ -5,21 +5,36 @@ state: directory - name: create store base directory + loop: "{{ whawty_auth_store_instances | dict2items }}" + loop_control: + label: "{{ item.key }}" file: - path: "{{ whawty_auth_store.config.basedir }}" + path: "{{ item.value.config.basedir }}" state: directory - mode: "{{ whawty_auth_store.permissions['dir-mode'] | default(omit) }}" - owner: "{{ whawty_auth_store.permissions.owner | default(omit) }}" - group: "{{ whawty_auth_store.permissions.group | default(omit) }}" + mode: "{{ item.value.permissions['dir-mode'] | default(omit) }}" + owner: "{{ item.value.permissions.owner | default(omit) }}" + group: "{{ item.value.permissions.group | default(omit) }}" - name: generate store config file + loop: "{{ whawty_auth_store_instances | dict2items }}" + loop_control: + label: "{{ item.key }}" copy: - content: "{{ whawty_auth_store.config | to_nice_yaml(indent=2) }}" - dest: "/etc/whawty/auth/store-{{ whawty_auth_store.name }}.yml" - mode: "{{ whawty_auth_store.permissions['file-mode'] | default(omit) }}" - owner: "{{ whawty_auth_store.permissions.owner | default(omit) }}" - group: "{{ whawty_auth_store.permissions.group | default(omit) }}" + content: "{{ item.value.config | to_nice_yaml(indent=2) }}" + dest: "/etc/whawty/auth/store-{{ item.key }}.yml" + mode: "{{ item.value.permissions['file-mode'] | default(omit) }}" + owner: "{{ item.value.permissions.owner | default(omit) }}" + group: "{{ item.value.permissions.group | default(omit) }}" + +- name: install rsync + when: "(whawty_auth_store_instances | dict2items | selectattr('value.sync', 'defined') | length) > 0" + apt: + name: rsync + state: present - name: configure sync - when: "'sync' in whawty_auth_store" - include_tasks: "sync-{{ whawty_auth_store.sync.type }}.yml" + loop: "{{ whawty_auth_store_instances | dict2items }}" + loop_control: + label: "{{ item.key }}" + when: "'sync' in item.value" + include_tasks: "sync-{{ item.value.sync.type }}.yml" diff --git a/roles/whawty/auth/store/tasks/sync-client.yml b/roles/whawty/auth/store/tasks/sync-client.yml index 77dce1d1..a45e4727 100644 --- a/roles/whawty/auth/store/tasks/sync-client.yml +++ b/roles/whawty/auth/store/tasks/sync-client.yml @@ -1,70 +1,65 @@ --- -- name: install rsync - apt: - name: rsync - state: present - - name: make sure sync client config directory exists file: - path: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync" + path: "/etc/whawty/auth/.store-{{ item.key }}-sync" state: directory - name: generate ssh config for whawty-auth store sync client copy: content: | Host whawty-auth-server - Hostname {{ whawty_auth_store.sync.hostname }} - {% if 'port' in whawty_auth_store.sync %} - Port {{ whawty_auth_store.sync.port }} + Hostname {{ item.value.sync.hostname }} + {% if 'port' in item.value.sync %} + Port {{ item.value.sync.port }} {% endif %} - User {{ whawty_auth_store.sync.user }} - IdentityFile /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/id_ed25519 + User {{ item.value.sync.user }} + IdentityFile /etc/whawty/auth/.store-{{ item.key }}-sync/id_ed25519 IdentitiesOnly yes - UserKnownHostsFile /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts + UserKnownHostsFile /etc/whawty/auth/.store-{{ item.key }}-sync/known_hosts ControlMaster auto - ControlPath /run/ssh-master.whawty-auth-store-sync-{{ whawty_auth_store.name }} + ControlPath /run/ssh-master.whawty-auth-store-sync-{{ item.key }} ControlPersist 300 - dest: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config" + dest: "/etc/whawty/auth/.store-{{ item.key }}-sync/ssh_config" - name: generate ssh keypair for sync client openssh_keypair: - path: /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/id_ed25519 + path: /etc/whawty/auth/.store-{{ item.key }}-sync/id_ed25519 type: ed25519 - comment: "whawty-auth-sync-{{ whawty_auth_store.name }}@{{ inventory_hostname }}" + comment: "whawty-auth-sync-{{ item.key }}@{{ inventory_hostname }}" - name: generate sync script copy: content: | #!/bin/bash {% set rsync_args = [] %} - {% if 'permissions' in whawty_auth_store %} - {% if 'file-mode' in whawty_auth_store.permissions %} - {% set _dummy = rsync_args.append(" --chmod=F"~whawty_auth_store.permissions['file-mode']) %} + {% if 'permissions' in item.value %} + {% if 'file-mode' in item.value.permissions %} + {% set _dummy = rsync_args.append(" --chmod=F"~item.value.permissions['file-mode']) %} {% endif %} - {% if 'owner' in whawty_auth_store.permissions %} - {% set _dummy = rsync_args.append(" --chown="~whawty_auth_store.permissions.owner~":"~whawty_auth_store.permissions.group) %} + {% if 'owner' in item.value.permissions %} + {% set _dummy = rsync_args.append(" --chown="~item.value.permissions.owner~":"~item.value.permissions.group) %} {% endif %} {% endif %} while true; do - /usr/bin/rsync -rtW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ whawty_auth_store.config.basedir }}' + /usr/bin/rsync -rtW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ item.key }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ item.value.config.basedir }}' sleep 60 done - dest: /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/run.sh + dest: /etc/whawty/auth/.store-{{ item.key }}-sync/run.sh mode: 0755 - name: generate known_hosts file - shell: "ssh-keyscan{% if 'port' in whawty_auth_store.sync %} -p {{ whawty_auth_store.sync.port }}{% endif %} {{ whawty_auth_store.sync.hostname }} > /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts" + shell: "ssh-keyscan{% if 'port' in item.value.sync %} -p {{ item.value.sync.port }}{% endif %} {{ item.value.sync.hostname }} > /etc/whawty/auth/.store-{{ item.key }}-sync/known_hosts" args: - creates: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts" + creates: "/etc/whawty/auth/.store-{{ item.key }}-sync/known_hosts" - name: install systemd units for whawty-auth store sync client template: src: "systemd.service.j2" - dest: "/etc/systemd/system/whawty-auth-store-sync-{{ whawty_auth_store.name }}.service" + dest: "/etc/systemd/system/whawty-auth-store-sync-{{ item.key }}.service" - name: make sure whawty-auth store sync client is enabled and started systemd: daemon_reload: yes - name: "whawty-auth-store-sync-{{ whawty_auth_store.name }}.service" + name: "whawty-auth-store-sync-{{ item.key }}.service" state: started enabled: yes diff --git a/roles/whawty/auth/store/templates/systemd.service.j2 b/roles/whawty/auth/store/templates/systemd.service.j2 index 2fe45642..7e066901 100644 --- a/roles/whawty/auth/store/templates/systemd.service.j2 +++ b/roles/whawty/auth/store/templates/systemd.service.j2 @@ -1,9 +1,9 @@ [Unit] -Description=sync for whawty-auth store {{ whawty_auth_store.name }} +Description=sync for whawty-auth store {{ item.key }} [Service] Type=simple -ExecStart=/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/run.sh +ExecStart=/etc/whawty/auth/.store-{{ item.key }}-sync/run.sh # systemd hardening-options AmbientCapabilities=CAP_CHOWN CAP_FOWNER @@ -20,7 +20,7 @@ ProtectHome=true ProtectKernelModules=true ProtectKernelTunables=true ProtectSystem=strict -ReadWritePaths={{ whawty_auth_store.config.basedir }} +ReadWritePaths={{ item.value.config.basedir }} RemoveIPC=true RestrictNamespaces=true RestrictRealtime=true -- cgit v1.2.3