feat: use become for tasks and refactoring

This commit is contained in:
wpetit 2022-07-21 10:04:17 +02:00
parent 1ef89637b8
commit b245d6cc72
7 changed files with 72 additions and 29 deletions

View File

@ -5,6 +5,7 @@ cadoles_pod_debian_repository: bullseye-dev
cadoles_pod_debian_repository_key_url: https://vulcain.cadoles.com/cadoles.gpg cadoles_pod_debian_repository_key_url: https://vulcain.cadoles.com/cadoles.gpg
# Hydra database configuration # Hydra database configuration
hydra_use_external_database: no
hydra_database_name: hydra hydra_database_name: hydra
hydra_database_user: hydra hydra_database_user: hydra
hydra_database_password: hydra hydra_database_password: hydra

View File

@ -3,33 +3,34 @@
service: service:
name: haproxy name: haproxy
state: restarted state: restarted
become: true
- name: Restart cadoles-pod-hydra-v1 - name: Restart cadoles-pod-hydra-v1
service: service:
name: cadoles-pod-hydra-v1 name: cadoles-pod-hydra-v1
state: restarted state: restarted
become: true
- name: Restart cadoles-pod-hydra-dispatcher-v1 - name: Restart cadoles-pod-hydra-dispatcher-v1
service: service:
name: cadoles-pod-hydra-dispatcher-v1 name: cadoles-pod-hydra-dispatcher-v1
state: restarted state: restarted
become: true
- name: Restart cadoles-pod-hydra-passwordless-v1 - name: Restart cadoles-pod-hydra-passwordless-v1
service: service:
name: cadoles-pod-hydra-passwordless-v1 name: cadoles-pod-hydra-passwordless-v1
state: restarted state: restarted
become: true
- name: Restart cadoles-pod-hydra-remote-user-v1 - name: Restart cadoles-pod-hydra-remote-user-v1
service: service:
name: cadoles-pod-hydra-remote-user-v1 name: cadoles-pod-hydra-remote-user-v1
state: restarted state: restarted
become: true
- name: Restart cadoles-pod-shibboleth-sp-v3 - name: Restart cadoles-pod-shibboleth-sp-v3
service: service:
name: cadoles-pod-shibboleth-sp-v3 name: cadoles-pod-shibboleth-sp-v3
state: restarted state: restarted
become: true
- name: Restart MySQL
service:
name: mysql
state: restarted

31
tasks/hydra-database.yml Normal file
View File

@ -0,0 +1,31 @@
---
- name: Install local database required packages
ansible.builtin.apt:
name:
- mariadb-server
- python3-pip
update_cache: yes
state: latest
become: true
- name: Install PyMySQL python package
ansible.builtin.pip:
name: PyMySQL
become: true
- name: Create Hydra database
community.mysql.mysql_db:
name: "{{ hydra_database_name }}"
login_unix_socket: /var/run/mysqld/mysqld.sock
state: present
become: true
- name: Create Hydra database user
community.mysql.mysql_user:
name: "{{ hydra_database_user }}"
password: "{{ hydra_database_password }}"
login_unix_socket: /var/run/mysqld/mysqld.sock
priv: '{{ hydra_database_name }}.*:ALL,GRANT'
state: present
become: true

View File

@ -6,6 +6,7 @@
- cadoles-pod-hydra-passwordless-v1 - cadoles-pod-hydra-passwordless-v1
update_cache: yes update_cache: yes
state: latest state: latest
become: true
- name: Configure cadoles-pod-hydra-passwordless-v1 - name: Configure cadoles-pod-hydra-passwordless-v1
template: template:
@ -16,3 +17,4 @@
dest: /etc/cadoles-pod-hydra-passwordless-v1.conf dest: /etc/cadoles-pod-hydra-passwordless-v1.conf
notify: notify:
- Restart cadoles-pod-hydra-passwordless-v1 - Restart cadoles-pod-hydra-passwordless-v1
become: true

View File

@ -7,6 +7,7 @@
- cadoles-pod-hydra-remote-user-v1 - cadoles-pod-hydra-remote-user-v1
update_cache: yes update_cache: yes
state: latest state: latest
become: true
- name: Configure cadoles-pod-hydra-remote-user-v1 - name: Configure cadoles-pod-hydra-remote-user-v1
template: template:
@ -19,6 +20,7 @@
dest: /etc/hydra-remote-user/conf.d/remote-user.yml dest: /etc/hydra-remote-user/conf.d/remote-user.yml
notify: notify:
- Restart cadoles-pod-hydra-remote-user-v1 - Restart cadoles-pod-hydra-remote-user-v1
become: true
- name: Configure cadoles-pod-hydra-remote-user-v1 (2) - name: Configure cadoles-pod-hydra-remote-user-v1 (2)
ansible.builtin.copy: ansible.builtin.copy:
@ -26,6 +28,7 @@
dest: /etc/hydra-remote-user/apache.conf dest: /etc/hydra-remote-user/apache.conf
notify: notify:
- Restart cadoles-pod-hydra-remote-user-v1 - Restart cadoles-pod-hydra-remote-user-v1
become: true
- name: Create cadoles-pod-shibboleth-sp-v3 expected directories - name: Create cadoles-pod-shibboleth-sp-v3 expected directories
file: file:
@ -34,6 +37,7 @@
with_items: with_items:
- /etc/shibboleth - /etc/shibboleth
- /etc/shibboleth/credentials - /etc/shibboleth/credentials
become: true
- name: Configure cadoles-pod-shibboleth-sp-v3 - name: Configure cadoles-pod-shibboleth-sp-v3
ansible.builtin.template: ansible.builtin.template:
@ -46,6 +50,7 @@
dest: /etc/shibboleth/attribute-map.inc.xml dest: /etc/shibboleth/attribute-map.inc.xml
notify: notify:
- Restart cadoles-pod-shibboleth-sp-v3 - Restart cadoles-pod-shibboleth-sp-v3
become: true
- name: Configure cadoles-pod-shibboleth-sp-v3 (2) - name: Configure cadoles-pod-shibboleth-sp-v3 (2)
ansible.builtin.copy: ansible.builtin.copy:
@ -53,3 +58,4 @@
dest: /etc/shibboleth/shibboleth2.xml.gotmpl dest: /etc/shibboleth/shibboleth2.xml.gotmpl
notify: notify:
- Restart cadoles-pod-shibboleth-sp-v3 - Restart cadoles-pod-shibboleth-sp-v3
become: true

View File

@ -8,50 +8,39 @@
- openssl - openssl
update_cache: yes update_cache: yes
state: present state: present
become: true
- name: Add LetsEncrypt missing intermediate certificates - name: Add LetsEncrypt missing intermediate certificates
command: "bash -c 'wget -O- --no-check-certificate https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash'" command: "bash -c 'wget -O- --no-check-certificate https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash'"
args: args:
creates: /etc/ssl/certs/lets-encrypt-e1.pem.pem creates: /etc/ssl/certs/lets-encrypt-e1.pem.pem
become: true
- name: Add cadoles-pod debian repository key - name: Add cadoles-pod debian repository key
ansible.builtin.apt_key: ansible.builtin.apt_key:
url: "{{ cadoles_pod_debian_repository_key_url }}" url: "{{ cadoles_pod_debian_repository_key_url }}"
state: present state: present
become: true
- name: Configure cadoles-pod debian repository - name: Configure cadoles-pod debian repository
ansible.builtin.apt_repository: ansible.builtin.apt_repository:
repo: "deb {{ cadoles_pod_debian_repository_url }} {{ cadoles_pod_debian_repository }} main" repo: "deb {{ cadoles_pod_debian_repository_url }} {{ cadoles_pod_debian_repository }} main"
state: present state: present
become: true
- name: Install core packages - name: Install core packages
ansible.builtin.apt: ansible.builtin.apt:
name: name:
- haproxy - haproxy
- mariadb-server
- python3-pip
- cadoles-pod-hydra-v1 - cadoles-pod-hydra-v1
- cadoles-pod-hydra-dispatcher-v1 - cadoles-pod-hydra-dispatcher-v1
update_cache: yes update_cache: yes
state: latest state: latest
become: true
- name: Install PyMySQL python package - name: Configure Hydra local database
ansible.builtin.pip: ansible.builtin.include_tasks: hydra-database.yml
name: PyMySQL when: not hydra_use_external_database
- name: Create Hydra database
community.mysql.mysql_db:
name: "{{ hydra_database_name }}"
login_unix_socket: /var/run/mysqld/mysqld.sock
state: present
- name: Create Hydra database user
community.mysql.mysql_user:
name: "{{ hydra_database_user }}"
password: "{{ hydra_database_password }}"
login_unix_socket: /var/run/mysqld/mysqld.sock
priv: '{{ hydra_database_name }}.*:ALL,GRANT'
state: present
- name: Configure HAProxy - name: Configure HAProxy
template: template:
@ -60,6 +49,7 @@
validate: "haproxy -c -f %s" validate: "haproxy -c -f %s"
notify: notify:
- Restart HAProxy - Restart HAProxy
become: true
- name: Configure cadoles-pod-hydra-v1 - name: Configure cadoles-pod-hydra-v1
template: template:
@ -68,10 +58,9 @@
with_items: with_items:
- src: cadoles-pod-hydra-v1.conf.j2 - src: cadoles-pod-hydra-v1.conf.j2
dest: /etc/cadoles-pod-hydra-v1.conf dest: /etc/cadoles-pod-hydra-v1.conf
- src: oidc-test-client.json.j2
dest: /etc/hydra/clients.d/oidc-test.json
notify: notify:
- Restart cadoles-pod-hydra-v1 - Restart cadoles-pod-hydra-v1
become: true
- name: Configure cadoles-pod-hydra-dispatcher-v1 - name: Configure cadoles-pod-hydra-dispatcher-v1
template: template:
@ -84,6 +73,7 @@
dest: /etc/hydra-dispatcher/conf.d/apps.yml dest: /etc/hydra-dispatcher/conf.d/apps.yml
notify: notify:
- Restart cadoles-pod-hydra-dispatcher-v1 - Restart cadoles-pod-hydra-dispatcher-v1
become: true
- name: Configure passwordless authentification if enabled - name: Configure passwordless authentification if enabled
ansible.builtin.include_tasks: hydra-passwordless.yml ansible.builtin.include_tasks: hydra-passwordless.yml

View File

@ -1,5 +1,16 @@
--- ---
- name: Create oidc-test OpenID Connect client configuration
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- src: oidc-test-client.json.j2
dest: /etc/hydra/clients.d/oidc-test.json
notify:
- Restart cadoles-pod-hydra-v1
become: true
- name: Start oidc-test app - name: Start oidc-test app
containers.podman.podman_container: containers.podman.podman_container:
name: oidc-test name: oidc-test
@ -15,3 +26,4 @@
OIDC_REDIRECT_URL: "http://{{ public_host }}:8080" OIDC_REDIRECT_URL: "http://{{ public_host }}:8080"
OIDC_POST_LOGOUT_REDIRECT_URL: "http://{{ public_host }}:8080" OIDC_POST_LOGOUT_REDIRECT_URL: "http://{{ public_host }}:8080"
HTTP_ADDRESS: 0.0.0.0:8080 HTTP_ADDRESS: 0.0.0.0:8080
become: true