You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
85 lines
2.4 KiB
85 lines
2.4 KiB
---
|
|
- name: 'install openssl'
|
|
apt:
|
|
pkg: 'openssl'
|
|
state: 'present'
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
tags:
|
|
- 'packages'
|
|
|
|
- name: 'update tls server ca'
|
|
copy:
|
|
content: '{{ ldap_tls_server_ca }}{{ tls_root_ca }}'
|
|
dest: '/etc/ldap/server_ca.crt'
|
|
tags:
|
|
- 'tls_int'
|
|
|
|
- name: 'update tls user ca'
|
|
copy:
|
|
content: '{{ ldap_tls_user_ca }}{{ tls_root_ca }}'
|
|
dest: '/etc/ldap/user_ca.crt'
|
|
tags:
|
|
- 'tls_int'
|
|
|
|
- name: 'generete and sign slapd tls certificate'
|
|
import_role: name='ca_cert'
|
|
vars:
|
|
ca_cert_common_name: '{{ host_fqdn }}'
|
|
ca_cert_proto: 'tls'
|
|
ca_cert_tls_ca_path: '/etc/ldap/server_ca.crt'
|
|
ca_cert_tls_key_path: '/etc/ldap/slapd.key'
|
|
ca_cert_tls_cert_path: '/etc/ldap/slapd.crt'
|
|
ca_cert_tls_csr_path: '/etc/ldap/slapd.csr'
|
|
tags:
|
|
- 'tls_int'
|
|
|
|
- name: 'set private key ownership'
|
|
file:
|
|
path: '/etc/ldap/slapd.key'
|
|
owner: 'openldap'
|
|
group: 'openldap'
|
|
mode: '600'
|
|
|
|
# !BUG! Fixed in Ansible dev using ldap_attrs instead of ldap_attr
|
|
# Setting the parameters twice in a row fix the problem.
|
|
# Ref: https://github.com/ansible/ansible/issues/25665
|
|
# **ToDO: Find the right combination, is still failing at the first run
|
|
# but works on the second iteration
|
|
- name: 'configuring TLS options (workaround)'
|
|
ldap_attr:
|
|
dn: 'cn=config'
|
|
name: '{{ item.name }}'
|
|
values: '{{ item.value }}'
|
|
loop:
|
|
- { name: 'olcTLSCertificateFile', value: '/etc/ldap/slapd.crt' }
|
|
- { name: 'olcTLSCertificateKeyFile', value: '/etc/ldap/slapd.key' }
|
|
- { name: 'olcTLSCACertificateFile', value: '/etc/ldap/user_ca.crt' }
|
|
failed_when: false
|
|
tags:
|
|
- 'tls_int'
|
|
|
|
- name: 'configuring TLS options'
|
|
ldap_attr:
|
|
dn: 'cn=config'
|
|
name: '{{ item.name }}'
|
|
values: '{{ item.value }}'
|
|
state: 'exact'
|
|
loop:
|
|
- { name: 'olcTLSCACertificateFile', value: '/etc/ldap/user_ca.crt' }
|
|
- { name: 'olcTLSCertificateFile', value: '/etc/ldap/slapd.crt' }
|
|
- { name: 'olcTLSCertificateKeyFile', value: '/etc/ldap/slapd.key' }
|
|
- { name: 'olcTLSVerifyClient', value: 'try' } # TLS Client Auth
|
|
- { name: 'olcTLSCipherSuite', value: 'SECURE:-VERS-ALL:+VERS-TLS1.3' } # TLSv1.3 Only
|
|
tags:
|
|
- 'tls_int'
|
|
|
|
- name: 'configuring slapd service'
|
|
lineinfile:
|
|
line: 'SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"'
|
|
regexp: '^SLAPD_SERVICES='
|
|
path: '/etc/default/slapd'
|
|
notify: 'restart slapd'
|
|
tags:
|
|
- 'tls_int'
|
|
...
|