feat: modularize playbook with tags

This commit is contained in:
wpetit 2023-10-25 11:38:08 +02:00
parent 2b4e669cc3
commit 547eb73d6c
5 changed files with 81 additions and 28 deletions

View File

@ -1,4 +1,6 @@
--- ---
install_only: false
# cadoles-pod repository configuration # cadoles-pod repository configuration
cadoles_pod_debian_repository_url: https://vulcain.cadoles.com cadoles_pod_debian_repository_url: https://vulcain.cadoles.com
cadoles_pod_debian_repository: bullseye-dev cadoles_pod_debian_repository: bullseye-dev
@ -15,7 +17,7 @@ cadoles_pod_hydra_oidc_v1_package_version: '*'
cadoles_pod_hydra_ldap_v1_package_version: '*' cadoles_pod_hydra_ldap_v1_package_version: '*'
# Hydra database configuration # Hydra database configuration
hydra_use_external_database: no hydra_use_external_database: false
hydra_database_name: hydra hydra_database_name: hydra
hydra_database_user: hydra hydra_database_user: hydra
hydra_database_password: hydra hydra_database_password: hydra
@ -61,6 +63,7 @@ hydra_clients:
# Hydra dispatcher configuration # Hydra dispatcher configuration
enable_hydra_dispatcher: true
hydra_dispatcher_cookie_path: "{{ haproxy_hydra_dispatcher_base_path }}" hydra_dispatcher_cookie_path: "{{ haproxy_hydra_dispatcher_base_path }}"
hydra_dispatcher_debug: no hydra_dispatcher_debug: no
hydra_dispatcher_admin_authorized_hosts: hydra_dispatcher_admin_authorized_hosts:

View File

@ -4,36 +4,42 @@
name: haproxy name: haproxy
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-hydra-v1 - name: Restart cadoles-pod-hydra-v1
service: service:
name: cadoles-pod-hydra-v1 name: cadoles-pod-hydra-v1
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-hydra-dispatcher-v1 - name: Restart cadoles-pod-hydra-dispatcher-v1
service: service:
name: cadoles-pod-hydra-dispatcher-v1 name: cadoles-pod-hydra-dispatcher-v1
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-hydra-passwordless-v1 - name: Restart cadoles-pod-hydra-passwordless-v1
service: service:
name: cadoles-pod-hydra-passwordless-v1 name: cadoles-pod-hydra-passwordless-v1
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-hydra-remote-user-v1 - name: Restart cadoles-pod-hydra-remote-user-v1
service: service:
name: cadoles-pod-hydra-remote-user-v1 name: cadoles-pod-hydra-remote-user-v1
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-shibboleth-sp-v3 - name: Restart cadoles-pod-shibboleth-sp-v3
service: service:
name: cadoles-pod-shibboleth-sp-v3 name: cadoles-pod-shibboleth-sp-v3
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-hydra-oidc-v1 - name: Restart cadoles-pod-hydra-oidc-v1
service: service:
@ -46,13 +52,16 @@
name: cadoles-pod-hydra-ldap-v1 name: cadoles-pod-hydra-ldap-v1
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Restart cadoles-pod-goweb-oidc-v1 - name: Restart cadoles-pod-goweb-oidc-v1
service: service:
name: cadoles-pod-goweb-oidc-v1 name: cadoles-pod-goweb-oidc-v1
state: restarted state: restarted
become: true become: true
when: not install_only
- name: Reload hydra clients - name: Reload hydra clients
ansible.builtin.include_tasks: ansible.builtin.include_tasks:
file: hydra-reload-clients.yml file: hydra-reload-clients.yml
when: not install_only

40
tasks/install-hydra.yml Normal file
View File

@ -0,0 +1,40 @@
---
- name: Install Hydra
ansible.builtin.apt:
name:
- cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
update_cache: yes
state: present
become: true
- name: Configure Hydra local database
ansible.builtin.include_tasks: hydra-database.yml
when: not hydra_use_external_database
- name: Configure cadoles-pod-hydra-v1
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- src: cadoles-pod-hydra-v1.conf.j2
dest: /etc/cadoles-pod-hydra-v1.conf
notify:
- Restart cadoles-pod-hydra-v1
become: true
- name: Check cadoles-pod-hydra-v1 status
service:
name: cadoles-pod-hydra-v1
state: started
become: true
- name: Create hydra-clients
template:
src: hydra-client.json.j2
dest: "/etc/hydra/clients.d/{{ item.client_id }}.json"
with_items: "{{ hydra_clients }}"
notify:
- Reload hydra clients
become: true

View File

@ -9,24 +9,28 @@
update_cache: yes update_cache: yes
state: present state: present
become: true become: true
tags: [ hydra-only ]
- name: Add LetsEncrypt missing intermediate certificates - name: Add LetsEncrypt missing intermediate certificates
command: "bash -c 'wget -O- --no-check-certificate https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash'" command: "bash -c 'wget -O- --no-check-certificate https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash'"
args: args:
creates: /etc/ssl/certs/lets-encrypt-e1.pem.pem creates: /etc/ssl/certs/lets-encrypt-e1.pem.pem
become: true become: true
tags: [ hydra-only ]
- name: Add cadoles-pod debian repository key - name: Add cadoles-pod debian repository key
ansible.builtin.apt_key: ansible.builtin.apt_key:
url: "{{ cadoles_pod_debian_repository_key_url }}" url: "{{ cadoles_pod_debian_repository_key_url }}"
state: present state: present
become: true become: true
tags: [ hydra-only ]
- name: Configure cadoles-pod debian repository - name: Configure cadoles-pod debian repository
ansible.builtin.apt_repository: ansible.builtin.apt_repository:
repo: "deb {{ cadoles_pod_debian_repository_url }} {{ cadoles_pod_debian_repository }} main" repo: "deb {{ cadoles_pod_debian_repository_url }} {{ cadoles_pod_debian_repository }} main"
state: present state: present
become: true become: true
tags: [ hydra-only ]
- name: Ensure sysctl configuration - name: Ensure sysctl configuration
ansible.posix.sysctl: ansible.posix.sysctl:
@ -39,39 +43,30 @@
- name: fs.inotify.max_user_watches - name: fs.inotify.max_user_watches
value: 204800 value: 204800
become: true become: true
tags: [ hydra-only ]
- name: Install core packages - name: Install HAProxy
ansible.builtin.apt: ansible.builtin.apt:
name: name:
- haproxy={{ haproxy_package_version }} - haproxy={{ haproxy_package_version }}
- cadoles-pod-hydra-v1={{ cadoles_pod_hydra_v1_package_version }}
- cadoles-pod-hydra-dispatcher-v1={{ cadoles_pod_hydra_dispatcher_v1_package_version }}
update_cache: yes update_cache: yes
state: present state: present
become: true become: true
tags: [ hydra-only ]
- name: Configure Hydra local database - name: Install Hydra
ansible.builtin.include_tasks: hydra-database.yml include_tasks:
when: not hydra_use_external_database file: ./install-hydra.yml
apply:
tags: [ hydra-only ]
tags: [ hydra-only ]
- name: Create hydra-clients - name: Install hydra-dispatcher
template: ansible.builtin.apt:
src: hydra-client.json.j2 name:
dest: "/etc/hydra/clients.d/{{ item.client_id }}.json" - cadoles-pod-hydra-dispatcher-v1={{ cadoles_pod_hydra_dispatcher_v1_package_version }}
with_items: "{{ hydra_clients }}" update_cache: yes
notify: state: present
- Reload hydra clients
become: true
- name: Configure cadoles-pod-hydra-v1
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- src: cadoles-pod-hydra-v1.conf.j2
dest: /etc/cadoles-pod-hydra-v1.conf
notify:
- Restart cadoles-pod-hydra-v1
become: true become: true
- name: Configure cadoles-pod-hydra-dispatcher-v1 - name: Configure cadoles-pod-hydra-dispatcher-v1
@ -108,11 +103,11 @@
- name: Start OIDC Test app if enabled - name: Start OIDC Test app if enabled
ansible.builtin.include_tasks: start-oidc-test.yml ansible.builtin.include_tasks: start-oidc-test.yml
when: enable_oidc_test_app when: enable_oidc_test_app and not install_only
- name: Stop OIDC Test app if disabled - name: Stop OIDC Test app if disabled
ansible.builtin.include_tasks: stop-oidc-test.yml ansible.builtin.include_tasks: stop-oidc-test.yml
when: not enable_oidc_test_app when: not enable_oidc_test_app and not install_only
- name: Configure HAProxy - name: Configure HAProxy
template: template:
@ -122,3 +117,4 @@
notify: notify:
- Restart HAProxy - Restart HAProxy
become: true become: true
tags: [ hydra-only ]

View File

@ -39,8 +39,9 @@ frontend http-in
mode http mode http
maxconn 2000 maxconn 2000
{% if enable_hydra_dispatcher %}
acl login_dispatcher path_beg -i {{ haproxy_hydra_dispatcher_base_path }} acl login_dispatcher path_beg -i {{ haproxy_hydra_dispatcher_base_path }}
{% endif %}
{% if enable_hydra_passwordless %} {% if enable_hydra_passwordless %}
acl login_passwordless path_beg -i {{ haproxy_hydra_passwordless_base_path }} acl login_passwordless path_beg -i {{ haproxy_hydra_passwordless_base_path }}
{% endif %} {% endif %}
@ -57,7 +58,9 @@ frontend http-in
acl oidc_test path_beg -i {{ haproxy_oidc_test_base_path }} acl oidc_test path_beg -i {{ haproxy_oidc_test_base_path }}
{% endif %} {% endif %}
{% if enable_hydra_dispatcher %}
use_backend hydra_dispatcher if login_dispatcher use_backend hydra_dispatcher if login_dispatcher
{% endif %}
{% if enable_hydra_passwordless %} {% if enable_hydra_passwordless %}
use_backend hydra_passwordless if login_passwordless use_backend hydra_passwordless if login_passwordless
{% endif %} {% endif %}
@ -86,6 +89,7 @@ backend hydra
http-request set-path %[path,regsub(^{{ haproxy_hydra_base_path }},)] http-request set-path %[path,regsub(^{{ haproxy_hydra_base_path }},)]
server hydra 127.0.0.1:4444 check server hydra 127.0.0.1:4444 check
{% if enable_hydra_dispatcher %}
# Backend Hydra Dispatcher # Backend Hydra Dispatcher
backend hydra_dispatcher backend hydra_dispatcher
balance roundrobin balance roundrobin
@ -94,6 +98,7 @@ backend hydra_dispatcher
http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_dispatcher_base_path }} http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_dispatcher_base_path }}
server hydra-login-dispatcher 127.0.0.1:3000 check server hydra-login-dispatcher 127.0.0.1:3000 check
{%- endif %}
{% if enable_hydra_passwordless %} {% if enable_hydra_passwordless %}
# Backend Hydra Passwordless # Backend Hydra Passwordless