Daniel Allaire
fa6ef8b031
- client_pki : root_ca.crt en 0644 (un cert racine est PUBLIC ; requis pour que les clients TLS non-root — keycloak, forgejo… — puissent vérifier). - serveur_keycloak : db-url-properties sslmode=verify-full + sslrootcert. Incident maîtrisé : 1er essai, keycloak (user keycloak) ne pouvait pas lire root_ca 0600 → SSO down → restauré en <1 min → corrigé (0644) → verify-full OK. Prouvé : realm 200, sslmode=verify-full, aucune erreur SSL/DB. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
110 lines
3.1 KiB
YAML
110 lines
3.1 KiB
YAML
---
|
|
- name: Exiger les secrets PKI (Vault)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- client_pki_ca_fingerprint | length > 0
|
|
- client_pki_provisioner_password | length > 0
|
|
fail_msg: >-
|
|
client_pki_ca_fingerprint et client_pki_provisioner_password
|
|
sont requis (a fournir via Ansible Vault).
|
|
|
|
- name: Assurer le repertoire des trousseaux apt
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Telecharger la cle de signature Smallstep
|
|
ansible.builtin.get_url:
|
|
url: "{{ client_pki_depot_cle_url }}"
|
|
dest: "{{ client_pki_depot_cle_fichier }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Ajouter le depot apt Smallstep
|
|
ansible.builtin.template:
|
|
src: smallstep.sources.j2
|
|
dest: /etc/apt/sources.list.d/smallstep.sources
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Installer step-cli
|
|
ansible.builtin.apt:
|
|
name: "{{ client_pki_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Creer le repertoire STEPPATH des certificats
|
|
ansible.builtin.file:
|
|
path: "{{ client_pki_steppath }}/certs"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Deployer le mot de passe du provisioner
|
|
ansible.builtin.copy:
|
|
content: "{{ client_pki_provisioner_password }}"
|
|
dest: "{{ client_pki_steppath }}/provisioner.pass"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Etablir la confiance dans l'AC interne (bootstrap + installation racine)
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca bootstrap
|
|
--ca-url {{ client_pki_ca_url }}
|
|
--fingerprint {{ client_pki_ca_fingerprint }}
|
|
--install --force
|
|
creates: "{{ client_pki_steppath }}/certs/root_ca.crt"
|
|
environment:
|
|
STEPPATH: "{{ client_pki_steppath }}"
|
|
|
|
- name: Rendre le certificat racine lisible par tous (cert public, requis par les clients TLS)
|
|
ansible.builtin.file:
|
|
path: "{{ client_pki_steppath }}/certs/root_ca.crt"
|
|
mode: "0644"
|
|
|
|
- name: Obtenir le certificat d'hote
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca certificate {{ client_pki_nom_cert }}
|
|
{{ client_pki_cert }} {{ client_pki_cle }}
|
|
--provisioner {{ client_pki_provisioner }}
|
|
--provisioner-password-file {{ client_pki_steppath }}/provisioner.pass
|
|
{% for s in client_pki_sans | select | unique %}--san {{ s }} {% endfor %}
|
|
--force
|
|
creates: "{{ client_pki_cert }}"
|
|
environment:
|
|
STEPPATH: "{{ client_pki_steppath }}"
|
|
|
|
- name: Deployer l'unite systemd de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.service.j2
|
|
dest: /etc/systemd/system/cert-renewer@.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Deployer le minuteur de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.timer.j2
|
|
dest: /etc/systemd/system/cert-renewer@.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Activer le renouvellement automatique du certificat d'hote
|
|
ansible.builtin.systemd:
|
|
name: "cert-renewer@{{ client_pki_nom_cert }}.timer"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|