140 lines
3.4 KiB
YAML
140 lines
3.4 KiB
YAML
# Alliance Boréale - Rôle Keycloak
|
|
# Couche: C3 (Gouvernance & Supervision)
|
|
# Objectif: Déployer IdP fédéré (SSO)
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
- name: "📦 Install dependencies"
|
|
ansible.builtin.apt:
|
|
name:
|
|
- openjdk-17-jre-headless
|
|
- python3-pip
|
|
- python3-psycopg2
|
|
- nginx
|
|
- openssl
|
|
state: present
|
|
update_cache: true
|
|
tags: keycloak
|
|
|
|
- name: "👤 Create keycloak user"
|
|
ansible.builtin.user:
|
|
name: keycloak
|
|
system: true
|
|
shell: /bin/false
|
|
home: /opt/keycloak
|
|
create_home: false
|
|
tags: keycloak
|
|
|
|
- name: "📁 Create keycloak directories"
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: keycloak
|
|
group: keycloak
|
|
mode: '0755'
|
|
loop:
|
|
- /opt/keycloak
|
|
- /var/log/keycloak
|
|
tags: keycloak
|
|
|
|
- name: "📥 Download Keycloak"
|
|
ansible.builtin.get_url:
|
|
url: "https://github.com/keycloak/keycloak/releases/download/{{ keycloak.version }}/keycloak-{{ keycloak.version }}.tar.gz"
|
|
dest: "/tmp/keycloak-{{ keycloak.version }}.tar.gz"
|
|
mode: '0644'
|
|
tags: keycloak
|
|
|
|
- name: "📦 Extract Keycloak"
|
|
ansible.builtin.unarchive:
|
|
src: "/tmp/keycloak-{{ keycloak.version }}.tar.gz"
|
|
dest: /opt/keycloak
|
|
remote_src: true
|
|
owner: keycloak
|
|
group: keycloak
|
|
extra_opts: [--strip-components=1]
|
|
creates: /opt/keycloak/bin/kc.sh
|
|
tags: keycloak
|
|
|
|
- name: "🗄️ Configure PostgreSQL for Keycloak"
|
|
ansible.builtin.import_tasks: database.yml
|
|
tags: keycloak
|
|
|
|
- name: "⚙️ Configure Keycloak"
|
|
ansible.builtin.template:
|
|
src: keycloak.conf.j2
|
|
dest: /opt/keycloak/conf/keycloak.conf
|
|
owner: keycloak
|
|
group: keycloak
|
|
mode: '0640'
|
|
notify: restart keycloak
|
|
tags: keycloak
|
|
|
|
- name: "🔨 Build Keycloak"
|
|
ansible.builtin.command:
|
|
cmd: /opt/keycloak/bin/kc.sh build
|
|
become: true
|
|
become_user: keycloak
|
|
args:
|
|
creates: /opt/keycloak/lib/quarkus/quarkus-application.dat
|
|
tags: keycloak
|
|
|
|
- name: "⚙️ Create systemd service"
|
|
ansible.builtin.template:
|
|
src: keycloak.service.j2
|
|
dest: /etc/systemd/system/keycloak.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: restart keycloak
|
|
tags: keycloak
|
|
|
|
- name: "✅ Start and enable Keycloak"
|
|
ansible.builtin.systemd:
|
|
name: keycloak
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|
|
tags: keycloak
|
|
|
|
- name: "⏳ Wait for Keycloak to be ready"
|
|
ansible.builtin.wait_for:
|
|
port: "{{ keycloak.http_port }}"
|
|
host: 127.0.0.1
|
|
timeout: 120
|
|
tags: keycloak
|
|
|
|
- name: "🌐 Configure Nginx reverse proxy"
|
|
ansible.builtin.import_tasks: nginx.yml
|
|
tags: keycloak
|
|
|
|
- name: "👑 Create admin user"
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
/opt/keycloak/bin/kcadm.sh config credentials
|
|
--server http://localhost:{{ keycloak.http_port }}
|
|
--realm master
|
|
--user {{ keycloak.admin_user }}
|
|
--password {{ keycloak.admin_password }}
|
|
become: true
|
|
become_user: keycloak
|
|
register: admin_created
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: true
|
|
tags: keycloak
|
|
|
|
- name: "🏰 Configure realms and clients"
|
|
ansible.builtin.import_tasks: realms.yml
|
|
tags: keycloak
|
|
|
|
- name: "🔥 Configure firewall"
|
|
ansible.builtin.import_tasks: firewall.yml
|
|
tags: keycloak
|
|
|
|
- name: "✅ Keycloak role completed"
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
✅ Keycloak deployed on {{ inventory_hostname }}
|
|
URL: https://{{ keycloak.hostname }}
|
|
Admin: {{ keycloak.admin_user }}
|
|
tags: keycloak
|