71 lines
2.2 KiB
YAML
71 lines
2.2 KiB
YAML
|
---
|
||
|
|
- name: Exiger la configuration OIDC (client, secret, redirect, upstream, cookie)
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- serveur_oauth2_proxy_client_id | length > 0
|
||
|
|
- serveur_oauth2_proxy_client_secret | length > 0
|
||
|
|
- serveur_oauth2_proxy_redirect_url | length > 0
|
||
|
|
- serveur_oauth2_proxy_upstream | length > 0
|
||
|
|
- serveur_oauth2_proxy_cookie_secret | length > 0
|
||
|
|
fail_msg: "client_id, client_secret (voûte), redirect_url, upstream et cookie_secret (voûte) requis."
|
||
|
|
|
||
|
|
- name: Créer l'utilisateur système oauth2-proxy
|
||
|
|
ansible.builtin.user:
|
||
|
|
name: "{{ serveur_oauth2_proxy_utilisateur }}"
|
||
|
|
system: true
|
||
|
|
shell: /usr/sbin/nologin
|
||
|
|
create_home: false
|
||
|
|
|
||
|
|
- name: Télécharger oauth2-proxy
|
||
|
|
ansible.builtin.get_url:
|
||
|
|
url: "{{ serveur_oauth2_proxy_url }}"
|
||
|
|
dest: "/tmp/oauth2-proxy-{{ serveur_oauth2_proxy_version }}.tar.gz"
|
||
|
|
mode: "0644"
|
||
|
|
|
||
|
|
- name: Extraire le binaire oauth2-proxy
|
||
|
|
ansible.builtin.unarchive:
|
||
|
|
src: "/tmp/oauth2-proxy-{{ serveur_oauth2_proxy_version }}.tar.gz"
|
||
|
|
dest: /usr/local/bin
|
||
|
|
remote_src: true
|
||
|
|
extra_opts: ["--strip-components=1", "--wildcards", "*/oauth2-proxy"]
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0755"
|
||
|
|
creates: "{{ serveur_oauth2_proxy_binaire }}"
|
||
|
|
notify: Redémarrer oauth2-proxy
|
||
|
|
|
||
|
|
- name: Créer le répertoire de configuration
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ serveur_oauth2_proxy_config | dirname }}"
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: "{{ serveur_oauth2_proxy_utilisateur }}"
|
||
|
|
mode: "0750"
|
||
|
|
|
||
|
|
- name: Déployer la configuration oauth2-proxy
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: oauth2-proxy.cfg.j2
|
||
|
|
dest: "{{ serveur_oauth2_proxy_config }}"
|
||
|
|
owner: root
|
||
|
|
group: "{{ serveur_oauth2_proxy_utilisateur }}"
|
||
|
|
mode: "0640"
|
||
|
|
no_log: true
|
||
|
|
notify: Redémarrer oauth2-proxy
|
||
|
|
|
||
|
|
- name: Déployer l'unité systemd oauth2-proxy
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: oauth2-proxy.service.j2
|
||
|
|
dest: /etc/systemd/system/oauth2-proxy.service
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0644"
|
||
|
|
notify: Redémarrer oauth2-proxy
|
||
|
|
|
||
|
|
- name: Activer et démarrer oauth2-proxy
|
||
|
|
when: not ansible_check_mode
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: "{{ serveur_oauth2_proxy_service }}"
|
||
|
|
enabled: true
|
||
|
|
state: started
|
||
|
|
daemon_reload: true
|