blob: e2267238407789c4db6d99f2d6af24172dbba019 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
---
- name: create configuration directory
file:
path: /etc/nginx/auth/whawty-sso
state: directory
- name: generate htpasswd files for static backends
loop: "{{ whawty_nginx_sso_logins | dict2items | selectattr('value.config.auth.static', 'defined') | selectattr('value.config.auth.static.htpasswd', 'undefined') }}"
loop_control:
label: "{{ item.key }}"
copy:
content: |
{% for user,password in lookup('vars', 'whawty_nginx_sso_login_static_credentials__'~item.key).items() %}
{{ user }}:{{ password | password_hash('bcrypt', (user~'@whawty-nginx-sso_'~item.key) | bcrypt_salt) }}
{% endfor %}
dest: "/etc/nginx/auth/whawty-sso/{{ item.key }}.htpasswd"
mode: 0400
- name: make sure store backend directories exist
loop: "{{ whawty_nginx_sso_logins | dict2items | selectattr('value.config.cookie.backend.bolt', 'defined') }}"
loop_control:
label: "{{ item.key }}"
file:
path: "{{ item.value.config.cookie.backend.bolt.path | default('/var/lib/whawty/nginx-sso/'~item.key~'.bolt') | dirname }}"
state: directory
mode: 0700
- name: generate configuration file
loop: "{{ whawty_nginx_sso_logins | dict2items }}"
loop_control:
label: "{{ item.key }}"
copy:
content: |
# ansible generated
{% set ssoconf = item.value.config %}
{% if 'static' in ssoconf.auth and 'htpasswd' not in ssoconf.auth.static %}
{% set _dummy = ssoconf.auth.static.update({'htpasswd': '/etc/nginx/auth/whawty-sso/'~item.key~'.htpasswd'}) %}
{% endif %}
{% if 'bolt' in ssoconf.cookie.backend and 'path' not in ssoconf.cookie.backend.bolt %}
{% set _dummy = ssoconf.cookie.backend.bolt.update({'path': '/var/lib/whawty/nginx-sso/'~item.key~'.bolt'}) %}
{% endif %}
{{ ssoconf | to_nice_yaml(indent=2) }}
dest: "/etc/nginx/auth/whawty-sso/{{ item.key }}.yml"
mode: 0400
notify: restart whawty-nginx-sso
- name: make sure nginx-sso services are enabled and started
loop: "{{ whawty_nginx_sso_logins | list }}"
systemd:
name: "whawty-nginx-sso@{{ item }}.service"
daemon_reload: yes
state: started
enabled: yes
- name: configure vhost for whawty nginx-sso login
loop: "{{ whawty_nginx_sso_logins | dict2items }}"
loop_control:
label: "{{ item.key }}"
vars:
nginx_vhost:
name: "whawty-nginx-sso-{{ item.key }}"
template: generic
hostnames:
- "{{ item.value.hostname }}"
tls: "{{ item.value.tls }}"
locations:
'/':
proxy_pass: "http://{{ item.value.config.web.listen }}/"
include_role:
name: nginx/vhost
|
