blob: 1ab43c8e58a1377ee1fb4c04cd8688b1c3830eb9 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
---
- name: create configuration directory
file:
path: /etc/nginx/auth/whawty-sso
state: directory
- name: generate htpasswd files for static backends
loop: "{{ whawty_nginx_sso_logins | dict2items | selectattr('value.config.auth.static', 'defined') | selectattr('value.config.auth.static.htpasswd', 'undefined') }}"
loop_control:
label: "{{ item.key }}"
copy:
content: |
{% for user,password in lookup('vars', 'whawty_nginx_sso_login_static_credentials__'~item.key).items() %}
{{ user }}:{{ password | password_hash('bcrypt', (user~'@whawty-nginx-sso_'~item.key) | bcrypt_salt) }}
{% endfor %}
dest: "/etc/nginx/auth/whawty-sso/{{ item.key }}.htpasswd"
mode: 0400
- name: generate configuration file
loop: "{{ whawty_nginx_sso_logins | dict2items }}"
loop_control:
label: "{{ item.key }}"
copy:
content: |
# ansible generated
{% set ssoconf = item.value.config %}
{% if 'static' in ssoconf.auth and 'htpasswd' not in ssoconf.auth.static %}
{% set _dummy = ssoconf.auth.static.update({'htpasswd': '/etc/nginx/auth/whawty-sso/'~item.key~'.htpasswd'}) %}
{% endif %}
{{ ssoconf | to_nice_yaml(indent=2) }}
dest: "/etc/nginx/auth/whawty-sso/{{ item.key }}.yml"
mode: 0400
notify: restart whawty-nginx-sso
- name: make sure nginx-sso services are enabled and started
loop: "{{ whawty_nginx_sso_logins | list }}"
systemd:
name: "whawty-nginx-sso@{{ item }}.service"
daemon_reload: yes
state: started
enabled: yes
- name: configure vhost for whawty nginx-sso login
loop: "{{ whawty_nginx_sso_logins | dict2items }}"
loop_control:
label: "{{ item.key }}"
vars:
nginx_vhost:
name: "whawty-nginx-sso-{{ item.key }}"
template: generic
tls:
certificate_provider: acmetool
certificate_config:
request:
challenge:
http-self-test: false
hostnames:
- "{{ item.value.hostname }}"
locations:
'/':
proxy_pass: "http://{{ item.value.config.web.listen }}/"
include_role:
name: nginx/vhost
|