rootnode-academy/infra/ansible/roles/docker-tls/tasks/main.yml

---
# Deploys Docker TLS material generated OFFLINE by infra/scripts/docker-tls/generate-docker-tls.sh
# — this role never generates key material itself, and the CA private key never touches either
# VM (see infra/docker/tls/README.md). Fails loudly if the operator forgot to set
# ROOTNODE_TLS_BUNDLE_DIR / run the generation script first, rather than silently skipping and
# leaving the Provisioner unable to reach rn-lab-host-01.

- name: Verify the local TLS bundle directory exists
  ansible.builtin.stat:
    path: "{{ docker_tls_local_bundle_dir }}"
  register: bundle_dir
  delegate_to: localhost
  become: false

- name: Fail fast if the TLS bundle wasn't generated
  ansible.builtin.fail:
    msg: >-
      ROOTNODE_TLS_BUNDLE_DIR ({{ docker_tls_local_bundle_dir }}) does not exist. Run
      infra/scripts/docker-tls/generate-docker-tls.sh first, then re-run with
      ROOTNODE_TLS_BUNDLE_DIR=<output dir> in the environment.
  when: not bundle_dir.stat.exists

- name: Create /etc/rootnode/docker-tls
  ansible.builtin.file:
    path: /etc/rootnode/docker-tls
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Deploy CA cert (public, both hosts)
  ansible.builtin.copy:
    src: "{{ docker_tls_local_bundle_dir }}/ca.pem"
    dest: /etc/rootnode/docker-tls/ca.pem
    owner: root
    group: root
    mode: "0444"

- name: Deploy server cert/key (rn-lab-host-01 only)
  ansible.builtin.copy:
    src: "{{ docker_tls_local_bundle_dir }}/{{ item.src }}"
    dest: "/etc/rootnode/docker-tls/{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - { src: server-cert.pem, dest: server-cert.pem, mode: "0444" }
    - { src: server-key.pem, dest: server-key.pem, mode: "0400" }
  when: inventory_hostname in groups['lab_host']
  notify: restart docker with tls

- name: Deploy Provisioner client cert/key (rn-platform-01 only)
  ansible.builtin.copy:
    src: "{{ docker_tls_local_bundle_dir }}/{{ item.src }}"
    dest: "/etc/rootnode/docker-tls/{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - { src: provisioner-client-cert.pem, dest: provisioner-client-cert.pem, mode: "0444" }
    - { src: provisioner-client-key.pem, dest: provisioner-client-key.pem, mode: "0400" }
  when: inventory_hostname in groups['platform']

- name: Configure dockerd for TLS (rn-lab-host-01 only)
  ansible.builtin.template:
    src: daemon.json.j2
    dest: /etc/docker/daemon.json
    owner: root
    group: root
    mode: "0644"
  when: inventory_hostname in groups['lab_host']
  notify: restart docker with tls

- name: Override the Docker systemd unit's ExecStart (clears the default -H fd:// flag)
  ansible.builtin.file:
    path: /etc/systemd/system/docker.service.d
    state: directory
    mode: "0755"
  when: inventory_hostname in groups['lab_host']

- name: Deploy the ExecStart override
  ansible.builtin.template:
    src: docker-override.conf.j2
    dest: /etc/systemd/system/docker.service.d/override.conf
    owner: root
    group: root
    mode: "0644"
  when: inventory_hostname in groups['lab_host']
  notify: restart docker with tls

# ── Phase 4.1: the DATA-plane mTLS pair (Gateway <-> Lab Host Router). Same CA as the
# CONTROL-plane pair above, separate directory (/etc/rootnode/lab-router-tls) so the two
# concerns stay bind-mount-separable — the `lab-router`/`gateway` containers only ever need
# their own pair mounted in, never the Docker TLS one. See
# docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1-3.
- name: Create /etc/rootnode/lab-router-tls
  ansible.builtin.file:
    path: /etc/rootnode/lab-router-tls
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Deploy CA cert for the data-plane pair (public, both hosts)
  ansible.builtin.copy:
    src: "{{ docker_tls_local_bundle_dir }}/ca.pem"
    dest: /etc/rootnode/lab-router-tls/ca.pem
    owner: root
    group: root
    mode: "0444"

- name: Deploy Lab Host Router server cert/key (rn-lab-host-01 only)
  ansible.builtin.copy:
    src: "{{ docker_tls_local_bundle_dir }}/{{ item.src }}"
    dest: "/etc/rootnode/lab-router-tls/{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - { src: router-server-cert.pem, dest: router-server-cert.pem, mode: "0444" }
    - { src: router-server-key.pem, dest: router-server-key.pem, mode: "0400" }
  when: inventory_hostname in groups['lab_host']
  notify: restart lab-router

- name: Deploy Gateway client cert/key (rn-platform-01 only)
  ansible.builtin.copy:
    src: "{{ docker_tls_local_bundle_dir }}/{{ item.src }}"
    dest: "/etc/rootnode/lab-router-tls/{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - { src: gateway-client-cert.pem, dest: gateway-client-cert.pem, mode: "0444" }
    - { src: gateway-client-key.pem, dest: gateway-client-key.pem, mode: "0400" }
  when: inventory_hostname in groups['platform']
  notify: restart gateway