102 lines
No EOL
3.2 KiB
YAML
102 lines
No EOL
3.2 KiB
YAML
- name: "Setup: Koji PKI Directory Structure"
|
|
tags: setup
|
|
block:
|
|
- name: "Create Koji PKI directory"
|
|
ansible.builtin.file:
|
|
path: "{{ koji_pki_dir }}"
|
|
state: directory
|
|
mode: "{{ koji_pki_dir_mode }}"
|
|
|
|
- name: "Create certificate database files"
|
|
ansible.builtin.copy:
|
|
content: "{{ item.content }}"
|
|
dest: "{{ koji_pki_dir }}/{{ item.name }}"
|
|
mode: "{{ koji_pki_file_mode }}"
|
|
loop:
|
|
- { name: "index.txt", content: "" }
|
|
- { name: "serial", content: "01\n" }
|
|
|
|
- name: "Generate: Koji Certificate Authority (CA)"
|
|
tags: ca
|
|
block:
|
|
- name: "Generate CA private key"
|
|
community.crypto.openssl_privatekey:
|
|
path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
|
|
size: "{{ koji_cert_key_size }}"
|
|
mode: "{{ koji_pki_private_key_mode }}"
|
|
|
|
- name: "Generate CA CSR"
|
|
community.crypto.openssl_csr:
|
|
path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.csr"
|
|
privatekey_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
|
|
common_name: "Koji Certificate Authority"
|
|
organization_name: "{{ koji_cert_organization }}"
|
|
state_or_province_name: "{{ koji_cert_state }}"
|
|
locality_name: "{{ koji_cert_locality }}"
|
|
country_name: "{{ koji_cert_country }}"
|
|
basic_constraints:
|
|
- "CA:TRUE"
|
|
key_usage:
|
|
- keyCertSign
|
|
- cRLSign
|
|
|
|
- name: "Generate self-signed CA certificate"
|
|
community.crypto.x509_certificate:
|
|
path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
|
|
csr_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.csr"
|
|
privatekey_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
|
|
provider: selfsigned
|
|
selfsigned_not_after: "+{{ koji_cert_expiration_days }}d"
|
|
|
|
- name: "Generate: Component and User Certificates"
|
|
ansible.builtin.include_tasks: generate_single_cert.yaml
|
|
loop: "{{ koji_certs_to_generate }}"
|
|
loop_control:
|
|
loop_var: cert
|
|
tags: components
|
|
|
|
- name: Create GPG key batch file
|
|
ansible.builtin.copy:
|
|
content: |
|
|
%echo Generating a basic OpenPGP key
|
|
Key-Type: RSA
|
|
Key-Length: 4096
|
|
Subkey-Type: RSA
|
|
Subkey-Length: 4096
|
|
Name-Real: Koji Signing Key
|
|
Name-Email: koji@{{ koji_hub_fqdn }}
|
|
Expire-Date: 0
|
|
Passphrase: {{ gpg_key_passphrase }}
|
|
%commit
|
|
%echo done
|
|
dest: "{{ koji_pki_dir }}/gpg_batch"
|
|
mode: "0600"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
|
|
- name: Generate GPG key
|
|
ansible.builtin.shell:
|
|
cmd: "gpg --batch --gen-key {{ koji_pki_dir }}/gpg_batch"
|
|
creates: "{{ koji_pki_dir }}/gpg_key.pub"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
|
|
- name: Export GPG public key
|
|
ansible.builtin.shell:
|
|
cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
|
|
creates: "{{ koji_pki_dir }}/gpg_key.pub"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
|
|
- name: "Remove existing host keys"
|
|
ansible.builtin.shell:
|
|
cmd: "ssh-keygen -R {{ item }}"
|
|
loop: "{{ groups['all'] }}"
|
|
ignore_errors: true
|
|
|
|
- name: "Add new host keys"
|
|
ansible.builtin.known_hosts:
|
|
name: "{{ item }}"
|
|
key: "{{ lookup('pipe', 'ssh-keyscan -t rsa {{ item }}') }}"
|
|
state: present
|
|
loop: "{{ groups['all'] }}" |