Daniel Allaire
ca0f95da28
serveurs_* -> serveur_, clients_ -> client_, suffixes pluriels au singulier (serveur_web_dorsal/frontal, client_metrique, client_journal). Renommage par tokens exacts : repertoires de roles, playbooks de groupes, group_vars, variables internes des roles (serveur_nginx_*, conformite ansible-lint), groupes du plan, constantes de code, docs. Faux-amis preserves (serveurs_bd, scripts/serveurs.py, fonctions Python). Groupes d'etat gardes au pluriel (hotes_actifs/planifies, modeles_vm). Valide : ansible-lint 0 echec (0 var-naming), diff vide de la generation, node --check, tous les registres. Ajout de .ansible-lint excluant docs/ (registres de donnees, pas du contenu Ansible). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
104 lines
2.9 KiB
YAML
104 lines
2.9 KiB
YAML
---
|
|
- name: Exiger les secrets PKI (Vault)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- client_pki_ca_fingerprint | length > 0
|
|
- client_pki_provisioner_password | length > 0
|
|
fail_msg: >-
|
|
client_pki_ca_fingerprint et client_pki_provisioner_password
|
|
sont requis (a fournir via Ansible Vault).
|
|
|
|
- name: Assurer le repertoire des trousseaux apt
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Telecharger la cle de signature Smallstep
|
|
ansible.builtin.get_url:
|
|
url: "{{ client_pki_depot_cle_url }}"
|
|
dest: "{{ client_pki_depot_cle_fichier }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Ajouter le depot apt Smallstep
|
|
ansible.builtin.template:
|
|
src: smallstep.sources.j2
|
|
dest: /etc/apt/sources.list.d/smallstep.sources
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Installer step-cli
|
|
ansible.builtin.apt:
|
|
name: "{{ client_pki_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Creer le repertoire STEPPATH des certificats
|
|
ansible.builtin.file:
|
|
path: "{{ client_pki_steppath }}/certs"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Deployer le mot de passe du provisioner
|
|
ansible.builtin.copy:
|
|
content: "{{ client_pki_provisioner_password }}"
|
|
dest: "{{ client_pki_steppath }}/provisioner.pass"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Etablir la confiance dans l'AC interne (bootstrap + installation racine)
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca bootstrap
|
|
--ca-url {{ client_pki_ca_url }}
|
|
--fingerprint {{ client_pki_ca_fingerprint }}
|
|
--install --force
|
|
creates: "{{ client_pki_steppath }}/certs/root_ca.crt"
|
|
environment:
|
|
STEPPATH: "{{ client_pki_steppath }}"
|
|
|
|
- name: Obtenir le certificat d'hote
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca certificate {{ client_pki_nom_cert }}
|
|
{{ client_pki_cert }} {{ client_pki_cle }}
|
|
--provisioner {{ client_pki_provisioner }}
|
|
--provisioner-password-file {{ client_pki_steppath }}/provisioner.pass
|
|
--force
|
|
creates: "{{ client_pki_cert }}"
|
|
environment:
|
|
STEPPATH: "{{ client_pki_steppath }}"
|
|
|
|
- name: Deployer l'unite systemd de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.service.j2
|
|
dest: /etc/systemd/system/cert-renewer@.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Deployer le minuteur de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.timer.j2
|
|
dest: /etc/systemd/system/cert-renewer@.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Activer le renouvellement automatique du certificat d'hote
|
|
ansible.builtin.systemd:
|
|
name: "cert-renewer@{{ client_pki_nom_cert }}.timer"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|