primer commit

roles/common/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/common/defaults/main.yml

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: MIT-0
+---
+# defaults file for roles/common
+
+# All common variables are now defined in vars/default.yaml for global access.
+
+# List of certificates to generate.
+# is_user: true will generate a .p12 file for browser import.
+koji_certs_to_generate:
+  - name: kojihub
+    cn: "{{ koji_hub_fqdn }}" # Server certs must use the FQDN for the CN
+    is_user: false
+  - name: kojiweb
+    cn: "{{ koji_hub_fqdn }}" # Server certs must use the FQDN for the CN
+    is_user: false
+  - name: kojira
+    cn: kojira
+    is_user: false
+  - name: kojid
+    cn: kojid
+    is_user: false
+  - name: kojiadmin
+    cn: kojiadmin
+    is_user: true
+  - name: postgresql
+    cn: "{{ koji_db_host }}"
+    is_user: false

roles/common/meta/main.yml

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: MIT-0
+---
+galaxy_info:
+  author: MxOS Team
+  description: Common tasks for Koji deployment
+  company: MxOS
+  license: MIT
+  min_ansible_version: "2.1"
+  galaxy_tags: []
+dependencies: []

roles/common/tasks/generate_single_cert.yaml

@@ -0,0 +1,75 @@
+---
+- name: "Generate private key for {{ cert.name }}"
+  community.crypto.openssl_privatekey:
+    path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
+    size: "{{ koji_cert_key_size }}"
+    mode: "{{ koji_pki_private_key_mode }}"
+
+- name: "Generate CSR for {{ cert.name }}"
+  community.crypto.openssl_csr:
+    path: "{{ koji_pki_dir }}/{{ cert.name }}.csr"
+    privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
+    common_name: "{{ cert.cn }}"
+    country_name: "{{ koji_cert_country }}"
+    state_or_province_name: "{{ koji_cert_state }}"
+    locality_name: "{{ koji_cert_locality }}"
+    organization_name: "{{ koji_cert_organization }}"
+
+- name: Create temporary OpenSSL config for signing
+  ansible.builtin.copy:
+    dest: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
+    content: |
+      [v3_ca]
+      basicConstraints = CA:FALSE
+      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+      {% if cert.is_server is defined and cert.is_server %}
+      extendedKeyUsage = serverAuth, clientAuth
+      {% else %}
+      extendedKeyUsage = clientAuth
+      {% endif %}
+      subjectAltName = @alt_names
+      [alt_names]
+      DNS.1 = {{ cert.cn }}
+      {% for san in cert.sans|default([]) %}
+      DNS.{{ loop.index + 1 }} = {{ san }}
+      {% endfor %}
+
+- name: "Sign certificate for {{ cert.name }} with our CA"
+  ansible.builtin.shell:
+    cmd: >
+      openssl x509 -req
+      -in {{ koji_pki_dir }}/{{ cert.name }}.csr
+      -CA {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt
+      -CAkey {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key
+      -CAserial {{ koji_pki_dir }}/ca.srl
+      -CAcreateserial
+      -out {{ koji_pki_dir }}/{{ cert.name }}.crt
+      -days {{ koji_cert_expiration_days }}
+      -sha256
+      -extfile {{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf
+      -extensions v3_ca
+    creates: "{{ koji_pki_dir }}/{{ cert.name }}.crt"
+
+- name: "Remove temporary openssl.cnf for {{ cert.name }}"
+  ansible.builtin.file:
+    path: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
+    state: absent
+
+
+
+- name: "Generate PKCS12 bundle for user {{ cert.name }}"
+  community.crypto.openssl_pkcs12:
+    action: export
+    path: "{{ koji_pki_dir }}/{{ cert.name }}_browser_cert.p12"
+    privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
+    certificate_path: "{{ koji_pki_dir }}/{{ cert.name }}.crt"
+    ca_certificates:
+      - "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
+    friendly_name: "{{ cert.name }}"
+    mode: "{{ koji_pki_file_mode }}"
+  when: cert.is_user
+
+- name: "Create PEM file for {{ cert.name }}"
+  ansible.builtin.shell:
+    cmd: "cat {{ koji_pki_dir }}/{{ cert.name }}.crt {{ koji_pki_dir }}/{{ cert.name }}.key > {{ koji_pki_dir }}/{{ cert.name }}.pem"
+    creates: "{{ koji_pki_dir }}/{{ cert.name }}.pem"

roles/common/tasks/main.yml

@@ -0,0 +1,102 @@
+- name: "Setup: Koji PKI Directory Structure"
+  tags: setup
+  block:
+    - name: "Create Koji PKI directory"
+      ansible.builtin.file:
+        path: "{{ koji_pki_dir }}"
+        state: directory
+        mode: "{{ koji_pki_dir_mode }}"
+
+    - name: "Create certificate database files"
+      ansible.builtin.copy:
+        content: "{{ item.content }}"
+        dest: "{{ koji_pki_dir }}/{{ item.name }}"
+        mode: "{{ koji_pki_file_mode }}"
+      loop:
+        - { name: "index.txt", content: "" }
+        - { name: "serial", content: "01\n" }
+
+- name: "Generate: Koji Certificate Authority (CA)"
+  tags: ca
+  block:
+    - name: "Generate CA private key"
+      community.crypto.openssl_privatekey:
+        path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
+        size: "{{ koji_cert_key_size }}"
+        mode: "{{ koji_pki_private_key_mode }}"
+
+    - name: "Generate CA CSR"
+      community.crypto.openssl_csr:
+        path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.csr"
+        privatekey_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
+        common_name: "Koji Certificate Authority"
+        organization_name: "{{ koji_cert_organization }}"
+        state_or_province_name: "{{ koji_cert_state }}"
+        locality_name: "{{ koji_cert_locality }}"
+        country_name: "{{ koji_cert_country }}"
+        basic_constraints:
+          - "CA:TRUE"
+        key_usage:
+          - keyCertSign
+          - cRLSign
+
+    - name: "Generate self-signed CA certificate"
+      community.crypto.x509_certificate:
+        path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
+        csr_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.csr"
+        privatekey_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
+        provider: selfsigned
+        selfsigned_not_after: "+{{ koji_cert_expiration_days }}d"
+
+- name: "Generate: Component and User Certificates"
+  ansible.builtin.include_tasks: generate_single_cert.yaml
+  loop: "{{ koji_certs_to_generate }}"
+  loop_control:
+    loop_var: cert
+  tags: components
+
+- name: Create GPG key batch file
+  ansible.builtin.copy:
+    content: |
+      %echo Generating a basic OpenPGP key
+      Key-Type: RSA
+      Key-Length: 4096
+      Subkey-Type: RSA
+      Subkey-Length: 4096
+      Name-Real: Koji Signing Key
+      Name-Email: koji@{{ koji_hub_fqdn }}
+      Expire-Date: 0
+      Passphrase: {{ gpg_key_passphrase }}
+      %commit
+      %echo done
+    dest: "{{ koji_pki_dir }}/gpg_batch"
+    mode: "0600"
+  delegate_to: localhost
+  run_once: true
+
+- name: Generate GPG key
+  ansible.builtin.shell:
+    cmd: "gpg --batch --gen-key {{ koji_pki_dir }}/gpg_batch"
+    creates: "{{ koji_pki_dir }}/gpg_key.pub"
+  delegate_to: localhost
+  run_once: true
+
+- name: Export GPG public key
+  ansible.builtin.shell:
+    cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
+    creates: "{{ koji_pki_dir }}/gpg_key.pub"
+  delegate_to: localhost
+  run_once: true
+
+- name: "Remove existing host keys"
+  ansible.builtin.shell:
+    cmd: "ssh-keygen -R {{ item }}"
+  loop: "{{ groups['all'] }}"
+  ignore_errors: true
+
+- name: "Add new host keys"
+  ansible.builtin.known_hosts:
+    name: "{{ item }}"
+    key: "{{ lookup('pipe', 'ssh-keyscan -t rsa {{ item }}') }}"
+    state: present
+  loop: "{{ groups['all'] }}"

roles/common/tests/inventory

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+localhost
+

roles/common/tests/test.yml

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MIT-0
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - roles/common

roles/common/vars/main.yml

@@ -0,0 +1,3 @@
+---
+common_ca_key_path: "{{ common_koji_pki_dir }}/{{ common_ca_name }}_cert.key"
+common_ca_cert_path: "{{ common_koji_pki_dir }}/{{ common_ca_name }}_cert.crt"