ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
90 lines
3.1 KiB
YAML
90 lines
3.1 KiB
YAML
---
|
|
# Deploys Docker TLS material generated OFFLINE by infra/scripts/docker-tls/generate-docker-tls.sh
|
|
# — this role never generates key material itself, and the CA private key never touches either
|
|
# VM (see infra/docker/tls/README.md). Fails loudly if the operator forgot to set
|
|
# ROOTNODE_TLS_BUNDLE_DIR / run the generation script first, rather than silently skipping and
|
|
# leaving the Provisioner unable to reach rn-lab-host-01.
|
|
|
|
- name: Verify the local TLS bundle directory exists
|
|
ansible.builtin.stat:
|
|
path: "{{ docker_tls_local_bundle_dir }}"
|
|
register: bundle_dir
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Fail fast if the TLS bundle wasn't generated
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
ROOTNODE_TLS_BUNDLE_DIR ({{ docker_tls_local_bundle_dir }}) does not exist. Run
|
|
infra/scripts/docker-tls/generate-docker-tls.sh first, then re-run with
|
|
ROOTNODE_TLS_BUNDLE_DIR=<output dir> in the environment.
|
|
when: not bundle_dir.stat.exists
|
|
|
|
- name: Create /etc/rootnode/docker-tls
|
|
ansible.builtin.file:
|
|
path: /etc/rootnode/docker-tls
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Deploy CA cert (public, both hosts)
|
|
ansible.builtin.copy:
|
|
src: "{{ docker_tls_local_bundle_dir }}/ca.pem"
|
|
dest: /etc/rootnode/docker-tls/ca.pem
|
|
owner: root
|
|
group: root
|
|
mode: "0444"
|
|
|
|
- name: Deploy server cert/key (rn-lab-host-01 only)
|
|
ansible.builtin.copy:
|
|
src: "{{ docker_tls_local_bundle_dir }}/{{ item.src }}"
|
|
dest: "/etc/rootnode/docker-tls/{{ item.dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { src: server-cert.pem, dest: server-cert.pem, mode: "0444" }
|
|
- { src: server-key.pem, dest: server-key.pem, mode: "0400" }
|
|
when: inventory_hostname in groups['lab_host']
|
|
notify: restart docker with tls
|
|
|
|
- name: Deploy Provisioner client cert/key (rn-platform-01 only)
|
|
ansible.builtin.copy:
|
|
src: "{{ docker_tls_local_bundle_dir }}/{{ item.src }}"
|
|
dest: "/etc/rootnode/docker-tls/{{ item.dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { src: provisioner-client-cert.pem, dest: provisioner-client-cert.pem, mode: "0444" }
|
|
- { src: provisioner-client-key.pem, dest: provisioner-client-key.pem, mode: "0400" }
|
|
when: inventory_hostname in groups['platform']
|
|
|
|
- name: Configure dockerd for TLS (rn-lab-host-01 only)
|
|
ansible.builtin.template:
|
|
src: daemon.json.j2
|
|
dest: /etc/docker/daemon.json
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: inventory_hostname in groups['lab_host']
|
|
notify: restart docker with tls
|
|
|
|
- name: Override the Docker systemd unit's ExecStart (clears the default -H fd:// flag)
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/docker.service.d
|
|
state: directory
|
|
mode: "0755"
|
|
when: inventory_hostname in groups['lab_host']
|
|
|
|
- name: Deploy the ExecStart override
|
|
ansible.builtin.template:
|
|
src: docker-override.conf.j2
|
|
dest: /etc/systemd/system/docker.service.d/override.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: inventory_hostname in groups['lab_host']
|
|
notify: restart docker with tls
|