migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,158 @@
|
||||
---
|
||||
- name: Generate Docker TLS certificates
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
certs_path: "<< certs_path >>"
|
||||
cert_validity_days: << cert_validity_days >>
|
||||
cn_domain: "<< cn_domain >>"
|
||||
|
||||
tasks:
|
||||
- name: Check if docker certs are existing
|
||||
ansible.builtin.stat:
|
||||
path: {{ certs_path }}
|
||||
register: certs_dir
|
||||
|
||||
- name: Create docker certs directory (if needed)
|
||||
ansible.builtin.file:
|
||||
path: {{ certs_path }}
|
||||
state: directory
|
||||
mode: '0700'
|
||||
when: not certs_dir.stat.exists
|
||||
|
||||
- name: Check if docker certs directory is empty
|
||||
ansible.builtin.command: ls -A {{ certs_path }}
|
||||
register: certs_list
|
||||
when: certs_dir.stat.exists
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Fail if docker certs already exist
|
||||
ansible.builtin.fail:
|
||||
msg: "Docker certificates already exist in /root/docker-certs."
|
||||
when: certs_list.stdout | default('') != ''
|
||||
|
||||
- name: Get machine's primary internal ip address from eth0 interface
|
||||
ansible.builtin.setup:
|
||||
register: ip_address
|
||||
|
||||
- name: Set machine's primary internal ip address
|
||||
ansible.builtin.set_fact:
|
||||
ip_address: {{ ip_address.ansible_facts.ansible_default_ipv4.address }}
|
||||
|
||||
- name: Check if ip_address is a valid ip address
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ip_address is match("^(?:[0-9]{1,3}\\.){3}[0-9]{1,3}$")
|
||||
fail_msg: "ip_address is not a valid ip address."
|
||||
success_msg: "ip_address is a valid ip address."
|
||||
|
||||
- name: Generate CA private key
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl genrsa -out {{ certs_path }}/ca-key.pem 4096
|
||||
args:
|
||||
creates: {{ certs_path }}/ca-key.pem
|
||||
|
||||
- name: Generate CA certificate
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl req -sha256 -new -x509
|
||||
-subj "/CN={{ cn_domain }}"
|
||||
-days {{ cert_validity_days }}
|
||||
-key {{ certs_path }}/ca-key.pem
|
||||
-out {{ certs_path }}/ca.pem
|
||||
args:
|
||||
creates: {{ certs_path }}/ca.pem
|
||||
|
||||
- name: Generate server private key
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl genrsa -out {{ certs_path }}/server-key.pem 4096
|
||||
creates: {{ certs_path }}/server-key.pem
|
||||
|
||||
- name: Generate server certificate signing request
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl req -sha256 -new
|
||||
-subj "/CN={{ inventory_hostname }}"
|
||||
-key {{ certs_path }}/server-key.pem
|
||||
-out {{ certs_path }}/server.csr
|
||||
creates: {{ certs_path }}/server.csr
|
||||
|
||||
- name: Generate server certificate extension file
|
||||
ansible.builtin.shell: |
|
||||
echo "subjectAltName = DNS:{{ inventory_hostname }},IP:{{ ip_address }},IP:127.0.0.1" >> {{ certs_path }}/extfile.cnf
|
||||
echo "extendedKeyUsage = serverAuth" >> {{ certs_path }}/extfile.cnf
|
||||
args:
|
||||
creates: {{ certs_path }}/extfile.cnf
|
||||
|
||||
- name: Generate server certificate
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl x509 -req -days {{ cert_validity_days }} -sha256
|
||||
-in {{ certs_path }}/server.csr
|
||||
-CA {{ certs_path }}/ca.pem
|
||||
-CAkey {{ certs_path }}/ca-key.pem
|
||||
-CAcreateserial -out {{ certs_path }}/server-cert.pem
|
||||
-extfile {{ certs_path }}/extfile.cnf
|
||||
creates: {{ certs_path }}/server-cert.pem
|
||||
|
||||
- name: Generate client private key
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl genrsa -out {{ certs_path }}/key.pem 4096
|
||||
creates: {{ certs_path }}/key.pem
|
||||
|
||||
- name: Generate client certificate signing request
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl req -sha256 -new
|
||||
-subj "/CN=client"
|
||||
-key {{ certs_path }}/key.pem
|
||||
-out {{ certs_path }}/client.csr
|
||||
creates: {{ certs_path }}/client.csr
|
||||
|
||||
- name: Generate client certificate extension file
|
||||
ansible.builtin.shell: |
|
||||
echo "extendedKeyUsage = clientAuth" >> {{ certs_path }}/client-extfile.cnf
|
||||
args:
|
||||
creates: {{ certs_path }}/client-extfile.cnf
|
||||
|
||||
- name: Generate client certificate
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl x509 -req -days {{ cert_validity_days }}
|
||||
-sha256 -in {{ certs_path }}/client.csr
|
||||
-CA {{ certs_path }}/ca.pem
|
||||
-CAkey {{ certs_path }}/ca-key.pem
|
||||
-CAcreateserial -out {{ certs_path }}/cert.pem
|
||||
-extfile {{ certs_path }}/client-extfile.cnf
|
||||
creates: {{ certs_path }}/cert.pem
|
||||
|
||||
- name: Remove client certificate signing request
|
||||
ansible.builtin.file:
|
||||
path: {{ certs_path }}/server.csr
|
||||
state: absent
|
||||
|
||||
- name: Remove client certificate signing request
|
||||
ansible.builtin.file:
|
||||
path: {{ certs_path }}/client.csr
|
||||
state: absent
|
||||
|
||||
- name: Remove server certificate extension file
|
||||
ansible.builtin.file:
|
||||
path: {{ certs_path }}/extfile.cnf
|
||||
state: absent
|
||||
|
||||
- name: Remove client certificate extension file
|
||||
ansible.builtin.file:
|
||||
path: {{ certs_path }}/client-extfile.cnf
|
||||
state: absent
|
||||
|
||||
- name: Set permissions for docker certs
|
||||
ansible.builtin.file:
|
||||
path: {{ certs_path }}
|
||||
mode: '0700'
|
||||
recurse: true
|
||||
follow: true
|
||||
@@ -0,0 +1,63 @@
|
||||
{
|
||||
"slug": "docker-certs",
|
||||
"kind": "ansible",
|
||||
"metadata": {
|
||||
"name": "Generate Docker TLS Certificates",
|
||||
"description": "Generates TLS certificates for the Docker daemon, including CA, server, and client certificates. Used to secure Docker remote API access.",
|
||||
"tags": [],
|
||||
"icon": {
|
||||
"provider": "simple-icons",
|
||||
"id": "docker"
|
||||
},
|
||||
"draft": true,
|
||||
"version": {
|
||||
"name": "1.0.0",
|
||||
"source_dep_name": "manual/docker-certs"
|
||||
}
|
||||
},
|
||||
"variables": [
|
||||
{
|
||||
"title": "Certificate Configuration",
|
||||
"name": "certificates",
|
||||
"items": [
|
||||
{
|
||||
"name": "certs_path",
|
||||
"type": "str",
|
||||
"title": "Certs Path",
|
||||
"required": false,
|
||||
"default": "/root/docker-certs",
|
||||
"description": "Path where certificates will be stored",
|
||||
"config": {
|
||||
"placeholder": "/root/docker-certs"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cert_validity_days",
|
||||
"type": "int",
|
||||
"title": "Validity Days",
|
||||
"required": false,
|
||||
"default": 3630,
|
||||
"description": "Certificate validity period in days",
|
||||
"config": {
|
||||
"slider": true,
|
||||
"min": 30,
|
||||
"max": 3650,
|
||||
"step": 30,
|
||||
"placeholder": "3650",
|
||||
"unit": "days"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cn_domain",
|
||||
"type": "str",
|
||||
"title": "CA Common Name",
|
||||
"required": false,
|
||||
"description": "Common Name (CN) for the CA certificate",
|
||||
"config": {
|
||||
"placeholder": "home.arpa.tld"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user