140 lines
4.1 KiB
YAML
140 lines
4.1 KiB
YAML
# Alliance Boréale - Keycloak Tasks (database, nginx, realms, firewall)
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
# ==========================================
|
|
# DATABASE.YML
|
|
# ==========================================
|
|
- name: "🗄️ Ensure PostgreSQL is installed"
|
|
ansible.builtin.include_role:
|
|
name: postgresql
|
|
when: "'postgresql_servers' in group_names"
|
|
|
|
- name: "🗄️ Create Keycloak database"
|
|
community.postgresql.postgresql_db:
|
|
name: "{{ keycloak.db.database }}"
|
|
encoding: UTF8
|
|
state: present
|
|
become: true
|
|
become_user: postgres
|
|
|
|
- name: "👤 Create Keycloak database user"
|
|
community.postgresql.postgresql_user:
|
|
name: "{{ keycloak.db.username }}"
|
|
password: "{{ keycloak.db.password }}"
|
|
state: present
|
|
become: true
|
|
become_user: postgres
|
|
no_log: true
|
|
|
|
- name: "🔐 Grant privileges to Keycloak user"
|
|
community.postgresql.postgresql_privs:
|
|
database: "{{ keycloak.db.database }}"
|
|
roles: "{{ keycloak.db.username }}"
|
|
type: database
|
|
privs: ALL
|
|
state: present
|
|
become: true
|
|
become_user: postgres
|
|
|
|
# ==========================================
|
|
# NGINX.YML
|
|
# ==========================================
|
|
- name: "📦 Ensure Nginx is installed"
|
|
ansible.builtin.apt:
|
|
name: nginx
|
|
state: present
|
|
|
|
- name: "🔐 Generate self-signed SSL certificate"
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:2048
|
|
-keyout /etc/ssl/private/{{ keycloak.hostname }}.key
|
|
-out /etc/ssl/certs/{{ keycloak.hostname }}.crt
|
|
-subj "/C=CA/ST=Quebec/L=Montreal/O=Chezlepro/CN={{ keycloak.hostname }}"
|
|
creates: "/etc/ssl/certs/{{ keycloak.hostname }}.crt"
|
|
when: nginx.ssl.cert_source == 'self-signed'
|
|
|
|
- name: "⚙️ Configure Nginx for Keycloak"
|
|
ansible.builtin.template:
|
|
src: nginx-keycloak.conf.j2
|
|
dest: /etc/nginx/sites-available/keycloak
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: reload nginx
|
|
|
|
- name: "🔗 Enable Nginx site"
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/keycloak
|
|
dest: /etc/nginx/sites-enabled/keycloak
|
|
state: link
|
|
notify: reload nginx
|
|
|
|
- name: "🚫 Remove default Nginx site"
|
|
ansible.builtin.file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
notify: reload nginx
|
|
|
|
- name: "✅ Start and enable Nginx"
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: started
|
|
enabled: true
|
|
|
|
# ==========================================
|
|
# REALMS.YML
|
|
# ==========================================
|
|
- name: "🏰 Check if realm exists"
|
|
ansible.builtin.uri:
|
|
url: "http://127.0.0.1:{{ keycloak.http_port }}/admin/realms/{{ item.name }}"
|
|
method: GET
|
|
user: "{{ keycloak.admin_user }}"
|
|
password: "{{ keycloak.admin_password }}"
|
|
force_basic_auth: true
|
|
status_code: [200, 404]
|
|
loop: "{{ keycloak.realms }}"
|
|
register: realm_check
|
|
changed_when: false
|
|
no_log: true
|
|
|
|
- name: "🏰 Create realm configuration file"
|
|
ansible.builtin.template:
|
|
src: realm-config.json.j2
|
|
dest: "/tmp/realm-{{ item.name }}.json"
|
|
owner: keycloak
|
|
group: keycloak
|
|
mode: '0640'
|
|
loop: "{{ keycloak.realms }}"
|
|
when: realm_check.results[0].status == 404
|
|
|
|
- name: "🏰 Import realm"
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
/opt/keycloak/bin/kc.sh import
|
|
--file /tmp/realm-{{ item.name }}.json
|
|
--override false
|
|
become: true
|
|
become_user: keycloak
|
|
loop: "{{ keycloak.realms }}"
|
|
when: realm_check.results[0].status == 404
|
|
register: realm_import
|
|
changed_when: "'imported' in realm_import.stdout"
|
|
|
|
# ==========================================
|
|
# FIREWALL.YML
|
|
# ==========================================
|
|
- name: "🔥 Configure firewall for Keycloak"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/nftables.conf
|
|
marker: "# {mark} ANSIBLE MANAGED - Keycloak"
|
|
insertbefore: "# Log dropped packets"
|
|
block: |
|
|
# Keycloak - Internal HTTP (backend only)
|
|
ip saddr 127.0.0.1 tcp dport {{ keycloak.http_port }} accept comment "Keycloak HTTP"
|
|
|
|
# Nginx - HTTPS (public)
|
|
tcp dport 443 accept comment "HTTPS (Keycloak via Nginx)"
|
|
tcp dport 80 accept comment "HTTP redirect"
|
|
notify: reload nftables
|