Daniel Allaire
c8ccbb5e97
Le garde 'creates:' sautait la ré-émission même quand les SAN voulus changeaient (ex: nouvelle exposition -> client_pki_sans mis à jour). Contourné 3× à la main ce soir. Corrigé : on lit les SAN du cert existant (openssl) et on ré-émet si le cert est absent OU si un SAN voulu manque, puis on recharge les consommateurs (client_pki_reload_services). Idempotent (SAN à jour -> sauté) + dérive détectée, prouvés. ansible-lint production : 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
125 lines
3.8 KiB
YAML
125 lines
3.8 KiB
YAML
---
|
|
- name: Exiger les secrets PKI (Vault)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- client_pki_ca_fingerprint | length > 0
|
|
- client_pki_provisioner_password | length > 0
|
|
fail_msg: >-
|
|
client_pki_ca_fingerprint et client_pki_provisioner_password
|
|
sont requis (a fournir via Ansible Vault).
|
|
|
|
- name: Assurer le repertoire des trousseaux apt
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Telecharger la cle de signature Smallstep
|
|
ansible.builtin.get_url:
|
|
url: "{{ client_pki_depot_cle_url }}"
|
|
dest: "{{ client_pki_depot_cle_fichier }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Ajouter le depot apt Smallstep
|
|
ansible.builtin.template:
|
|
src: smallstep.sources.j2
|
|
dest: /etc/apt/sources.list.d/smallstep.sources
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Installer step-cli
|
|
ansible.builtin.apt:
|
|
name: "{{ client_pki_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Creer le repertoire STEPPATH des certificats
|
|
ansible.builtin.file:
|
|
path: "{{ client_pki_steppath }}/certs"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Deployer le mot de passe du provisioner
|
|
ansible.builtin.copy:
|
|
content: "{{ client_pki_provisioner_password }}"
|
|
dest: "{{ client_pki_steppath }}/provisioner.pass"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Etablir la confiance dans l'AC interne (bootstrap + installation racine)
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca bootstrap
|
|
--ca-url {{ client_pki_ca_url }}
|
|
--fingerprint {{ client_pki_ca_fingerprint }}
|
|
--install --force
|
|
creates: "{{ client_pki_steppath }}/certs/root_ca.crt"
|
|
environment:
|
|
STEPPATH: "{{ client_pki_steppath }}"
|
|
|
|
- name: Rendre le certificat racine lisible par tous (cert public, requis par les clients TLS)
|
|
ansible.builtin.file:
|
|
path: "{{ client_pki_steppath }}/certs/root_ca.crt"
|
|
mode: "0644"
|
|
|
|
- name: Lire les SAN du certificat d'hote existant (detection de derive)
|
|
ansible.builtin.command:
|
|
cmd: "openssl x509 -in {{ client_pki_cert }} -noout -ext subjectAltName"
|
|
register: client_pki_san_actuels
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
# Re-emet si le cert est absent OU si un SAN voulu manque (ex: nouvelle exposition
|
|
# ajoutee au plan -> client_pki_sans mis a jour). Plus de garde 'creates' aveugle.
|
|
- name: Obtenir / re-emettre le certificat d'hote (absent ou SAN derives)
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca certificate {{ client_pki_nom_cert }}
|
|
{{ client_pki_cert }} {{ client_pki_cle }}
|
|
--provisioner {{ client_pki_provisioner }}
|
|
--provisioner-password-file {{ client_pki_steppath }}/provisioner.pass
|
|
{% for s in client_pki_sans | select | unique %}--san {{ s }} {% endfor %}
|
|
--force
|
|
environment:
|
|
STEPPATH: "{{ client_pki_steppath }}"
|
|
when: >-
|
|
client_pki_san_actuels.rc != 0
|
|
or (client_pki_sans | select | unique | reject('equalto', '')
|
|
| reject('in', client_pki_san_actuels.stdout | default(''))
|
|
| list | length > 0)
|
|
changed_when: true
|
|
notify: Recharger les consommateurs du cert
|
|
|
|
- name: Deployer l'unite systemd de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.service.j2
|
|
dest: /etc/systemd/system/cert-renewer@.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Deployer le minuteur de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.timer.j2
|
|
dest: /etc/systemd/system/cert-renewer@.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Activer le renouvellement automatique du certificat d'hote
|
|
ansible.builtin.systemd:
|
|
name: "cert-renewer@{{ client_pki_nom_cert }}.timer"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|