Daniel Allaire
0a0563c226
Rôle utilitaire partagé resoudre_annuaire (comme resoudre_base) : dérive la connexion OpenLDAP du domaine_interne + un hôte surchargeable, au lieu de répéter ldaps://id-ldap-01... dans chaque rôle. Facts uri/port/base_dn/ users_dn/bind_dn/bind_password (secret no_log). Migrés + prouvés (config neutre, changed=0) : keycloak (fédération, testmail token 200), dovecot + postfix (flux courriel livré de bout en bout). Piège : les defaults d'un rôle inclus ne persistent pas hors de son exécution — publier via set_fact. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
134 lines
4.3 KiB
YAML
134 lines
4.3 KiB
YAML
---
|
|
- name: Exiger le mot de passe admin Keycloak (Vault)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- serveur_keycloak_admin_password | length > 0
|
|
fail_msg: "serveur_keycloak_admin_password est requis (Ansible Vault)."
|
|
|
|
- name: Resoudre la base de donnees depuis le registre (role partage)
|
|
ansible.builtin.include_role:
|
|
name: resoudre_base
|
|
vars:
|
|
resoudre_base_groupe: "{{ serveur_keycloak_groupe }}"
|
|
|
|
- name: Adopter les facts de base pour Keycloak
|
|
ansible.builtin.set_fact:
|
|
serveur_keycloak_entree: "{{ resoudre_base_entree }}"
|
|
serveur_keycloak_db_password: "{{ resoudre_base_db_password }}"
|
|
serveur_keycloak_db_host: "{{ resoudre_base_db_host }}"
|
|
no_log: true
|
|
|
|
- name: Resoudre l'annuaire (role partage)
|
|
ansible.builtin.include_role:
|
|
name: resoudre_annuaire
|
|
when: serveur_keycloak_ldap_federation | bool
|
|
|
|
- name: Adopter la connexion annuaire pour Keycloak
|
|
ansible.builtin.set_fact:
|
|
serveur_keycloak_ldap_url: "{{ resoudre_annuaire_uri }}:{{ resoudre_annuaire_port }}"
|
|
serveur_keycloak_ldap_users_dn: "{{ resoudre_annuaire_users_dn }}"
|
|
serveur_keycloak_ldap_bind_dn: "{{ resoudre_annuaire_bind_dn }}"
|
|
serveur_keycloak_ldap_bind_password: "{{ resoudre_annuaire_bind_password }}"
|
|
no_log: true
|
|
when: serveur_keycloak_ldap_federation | bool
|
|
|
|
- name: Installer le JRE
|
|
ansible.builtin.apt:
|
|
name: "{{ serveur_keycloak_java_paquet }}"
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Creer l'utilisateur systeme keycloak
|
|
ansible.builtin.user:
|
|
name: "{{ serveur_keycloak_utilisateur }}"
|
|
system: true
|
|
home: "{{ serveur_keycloak_home }}"
|
|
create_home: false
|
|
shell: /usr/sbin/nologin
|
|
|
|
- name: Creer le repertoire d'installation
|
|
ansible.builtin.file:
|
|
path: "{{ serveur_keycloak_home }}"
|
|
state: directory
|
|
owner: "{{ serveur_keycloak_utilisateur }}"
|
|
group: "{{ serveur_keycloak_utilisateur }}"
|
|
mode: "0750"
|
|
|
|
- name: Telecharger la distribution Keycloak
|
|
ansible.builtin.get_url:
|
|
url: "{{ serveur_keycloak_url }}"
|
|
dest: "/tmp/keycloak-{{ serveur_keycloak_version }}.tar.gz"
|
|
mode: "0644"
|
|
|
|
- name: Extraire Keycloak
|
|
ansible.builtin.unarchive:
|
|
src: "/tmp/keycloak-{{ serveur_keycloak_version }}.tar.gz"
|
|
dest: "{{ serveur_keycloak_home }}"
|
|
remote_src: true
|
|
extra_opts: ["--strip-components=1"]
|
|
owner: "{{ serveur_keycloak_utilisateur }}"
|
|
group: "{{ serveur_keycloak_utilisateur }}"
|
|
creates: "{{ serveur_keycloak_home }}/bin/kc.sh"
|
|
|
|
- name: Deployer keycloak.conf (config non sensible)
|
|
ansible.builtin.template:
|
|
src: keycloak.conf.j2
|
|
dest: "{{ serveur_keycloak_home }}/conf/keycloak.conf"
|
|
owner: "{{ serveur_keycloak_utilisateur }}"
|
|
group: "{{ serveur_keycloak_utilisateur }}"
|
|
mode: "0640"
|
|
notify: Redemarrer keycloak
|
|
|
|
- name: Creer le repertoire de configuration des secrets
|
|
ansible.builtin.file:
|
|
path: /etc/keycloak
|
|
state: directory
|
|
owner: root
|
|
group: "{{ serveur_keycloak_utilisateur }}"
|
|
mode: "0750"
|
|
|
|
- name: Deployer le fichier d'environnement (secrets)
|
|
ansible.builtin.template:
|
|
src: keycloak.env.j2
|
|
dest: /etc/keycloak/keycloak.env
|
|
owner: root
|
|
group: "{{ serveur_keycloak_utilisateur }}"
|
|
mode: "0640"
|
|
no_log: true
|
|
notify: Redemarrer keycloak
|
|
|
|
- name: Construire Keycloak (une fois par version)
|
|
ansible.builtin.shell:
|
|
cmd: >-
|
|
{{ serveur_keycloak_home }}/bin/kc.sh build --db=postgres
|
|
&& touch {{ serveur_keycloak_home }}/.kc-built-{{ serveur_keycloak_version }}
|
|
creates: "{{ serveur_keycloak_home }}/.kc-built-{{ serveur_keycloak_version }}"
|
|
become: true
|
|
become_user: "{{ serveur_keycloak_utilisateur }}"
|
|
notify: Redemarrer keycloak
|
|
|
|
- name: Deployer l'unite systemd keycloak
|
|
ansible.builtin.template:
|
|
src: keycloak.service.j2
|
|
dest: /etc/systemd/system/keycloak.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Redemarrer keycloak
|
|
|
|
- name: Activer et demarrer keycloak
|
|
when: not ansible_check_mode
|
|
ansible.builtin.systemd:
|
|
name: "{{ serveur_keycloak_service }}"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
- name: Configurer la federation LDAP (realm + provider OpenLDAP)
|
|
ansible.builtin.include_tasks: federation-ldap.yml
|
|
when: serveur_keycloak_ldap_federation | bool
|
|
|
|
- name: Enregistrer les clients OIDC applicatifs
|
|
ansible.builtin.include_tasks: clients-oidc.yml
|
|
when: serveur_keycloak_clients | length > 0
|