Playbooks to a new Lilik
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 

82 lines
2.2 KiB

---
- name: 'install openssl'
apt:
pkg: 'openssl'
state: 'present'
update_cache: true
cache_valid_time: 3600
tags:
- 'packages'
- name: 'update tls server ca'
copy:
content: '{{ ldap_tls_server_ca }}{{ tls_root_ca }}'
dest: '/etc/ldap/server_ca.crt'
tags:
- 'tls_int'
- name: 'update tls user ca'
copy:
content: '{{ ldap_tls_user_ca }}{{ tls_root_ca }}'
dest: '/etc/ldap/user_ca.crt'
tags:
- 'tls_int'
- name: 'generete and sign slapd tls certificate'
import_role: name='ca_cert'
vars:
ca_cert_common_name: '{{ host_fqdn }}'
ca_cert_proto: 'tls'
ca_cert_tls_ca_path: '/etc/ldap/server_ca.crt'
ca_cert_tls_key_path: '/etc/ldap/slapd.key'
ca_cert_tls_cert_path: '/etc/ldap/slapd.crt'
ca_cert_tls_csr_path: '/etc/ldap/slapd.csr'
tags:
- 'tls_int'
- name: 'set private key ownership'
file:
path: '/etc/ldap/slapd.key'
owner: 'openldap'
group: 'openldap'
mode: '600'
## BROKEN! WAITING FOR ANSIBLE 2.10 ldap_attrs
## Currently you have to run 2-3 times to get proper configuration.
- name: 'configuring TLS options'
## Remove after update to Ansible 2.10 --->
ldap_attr:
dn: 'cn=config'
name: '{{ item.name }}'
values: '{{ item.value }}'
state: 'exact'
loop:
- { name: 'olcTLSCACertificateFile', value: '/etc/ldap/user_ca.crt' }
- { name: 'olcTLSCertificateFile', value: '/etc/ldap/slapd.crt' }
- { name: 'olcTLSCertificateKeyFile', value: '/etc/ldap/slapd.key' }
- { name: 'olcTLSVerifyClient', value: 'try' } # TLS Client Auth
- { name: 'olcTLSCipherSuite', value: 'SECURE:-VERS-ALL:+VERS-TLS1.3' } # TLSv1.3 Only
## <---
## Uncomment after update to Ansible 2.10 --->
# ldap_attrs:
# dn: 'cn=config'
# attributes:
# olcTLSCACertificateFile: '/etc/ldap/user_ca.crt'
# olcTLSCertificateFile: '/etc/ldap/slapd.crt'
# olcTLSCertificateKeyFile: '/etc/ldap/slapd.key'
# olcTLSVerifyClient: 'try'
# olcTLSCipherSuite: 'SECURE:-VERS-ALL:+VERS-TLS1.3'
## <---
tags:
- 'tls_int'
- name: 'configuring slapd service'
lineinfile:
line: 'SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"'
regexp: '^SLAPD_SERVICES='
path: '/etc/default/slapd'
notify: 'restart slapd'
tags:
- 'tls_int'
...