forked from infra/ansible
124 lines
2.7 KiB
YAML
124 lines
2.7 KiB
YAML
|
---
|
||
|
|
- name: Install sigul-pesign-bridge package
|
||
|
|
ansible.builtin.package:
|
||
|
|
state: present
|
||
|
|
name: sigul-pesign-bridge
|
||
|
|
tags:
|
||
|
|
- packages
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Install sbverify package
|
||
|
|
ansible.builtin.package:
|
||
|
|
state: present
|
||
|
|
name: sbsigntools
|
||
|
|
when: siguldry_pesign_bridge_install_sbverify | default(true)
|
||
|
|
tags:
|
||
|
|
- packages
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Create sigul-pesign-bridge config directory
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/sigul-pesign-bridge
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: '0755'
|
||
|
|
tags:
|
||
|
|
- config
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Create credstore.encrypted directory
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/credstore.encrypted
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: '0700'
|
||
|
|
tags:
|
||
|
|
- config
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Setup sigul-pesign-bridge config file
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: config.toml.j2
|
||
|
|
dest: /etc/sigul-pesign-bridge/config.toml
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: '0644'
|
||
|
|
notify: restart sigul-pesign-bridge
|
||
|
|
tags:
|
||
|
|
- config
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Create pesign group
|
||
|
|
ansible.builtin.group:
|
||
|
|
name: pesign
|
||
|
|
state: present
|
||
|
|
tags:
|
||
|
|
- users
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Add users to pesign group
|
||
|
|
ansible.builtin.user:
|
||
|
|
name: "{{ item }}"
|
||
|
|
groups: pesign
|
||
|
|
append: yes
|
||
|
|
loop: "{{ siguldry_pesign_bridge_users | default([]) }}"
|
||
|
|
when: siguldry_pesign_bridge_users is defined
|
||
|
|
tags:
|
||
|
|
- users
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Setup client certificate
|
||
|
|
ansible.builtin.copy:
|
||
|
|
src: "{{ private }}"/files/sigulca/production/pki/issued/sigul-pesign-bridge.crt
|
||
|
|
dest: /etc/sigul-pesign-bridge/client.crt
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: '0644'
|
||
|
|
tags:
|
||
|
|
- config
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Setup CA certificate
|
||
|
|
ansible.builtin.copy:
|
||
|
|
src: "{{ private }}"/files/sigulca/production/pki/ca.crt
|
||
|
|
dest: /etc/sigul-pesign-bridge/ca.crt
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: '0644'
|
||
|
|
tags:
|
||
|
|
- config
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Enable and start sigul-pesign-bridge service
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: sigul-pesign-bridge.service
|
||
|
|
enabled: yes
|
||
|
|
state: started
|
||
|
|
daemon_reload: yes
|
||
|
|
tags:
|
||
|
|
- services
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|
||
|
|
|
||
|
|
- name: Mock site-defaults.cfg for pesign builders.
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: pesign-builder-site-defaults.cfg.j2
|
||
|
|
dest: /etc/mock/site-defaults.cfg
|
||
|
|
mode: "0644"
|
||
|
|
owner: root
|
||
|
|
group: mock
|
||
|
|
tags:
|
||
|
|
- services
|
||
|
|
- siguldry
|
||
|
|
- siguldry/pesign_bridge
|