Skip to content

Commit 2fa6302

Browse files
lbaker-esnetlbaker-esnet
authored
Merge pull request #37 from esnet/develop/ansible-role
ansible role & playbooks to install, uninstall acme-proxy
2 parents 7d510d9 + 7490b37 commit 2fa6302

22 files changed

Lines changed: 470 additions & 27 deletions

File tree

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,9 @@ db
1111
.gitlab-ci.yml
1212
CHANGES.md
1313
COMPARISON.md
14+
.venv
15+
*.lock
16+
*.log
17+
.python-version
18+
.ansible
19+
pyproject.toml

‎ansible/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Deploy acme-proxy using Ansible

‎ansible/ansible.cfg‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
[defaults]
2+
host_key_checking = False
3+
nocows = True
4+
roles_path = ./roles
5+
collections_path= ./collections
6+
inventory = ./inventory/hosts.ini
7+
filter_plugins = ./filter_plugins
8+
#stdout_callback = yaml
9+
bin_ansible_callbacks = True
10+
ansible_managed = Ansible managed: {file} on {host}
11+
retry_files_enabled = False
12+
timeout = 20
13+
log_path = ./ansible.log
14+
15+
[ssh_connection]
16+
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60m
17+
control_path = ~/.ssh/master-%%r@%%h:%%p
18+
pipelining = True
19+
20+
[privilege_escalation]
21+
become_flags = -H -S

‎ansible/playbooks/install.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
- name: Install acme-proxy
3+
hosts: all
4+
become: true
5+
6+
# vars:
7+
# Required — no functional defaults exist for these.
8+
# Set them here, in group_vars/host_vars, or pass via -e at runtime.
9+
# acme_proxy_ca_url: ""
10+
# acme_proxy_account_email: ""
11+
# acme_proxy_dns_names:
12+
# - ""
13+
14+
# Optional — override role defaults as needed.
15+
# acme_proxy_version: latest
16+
# acme_proxy_eab_kid: ""
17+
# acme_proxy_eab_hmac_key: ""
18+
19+
roles:
20+
- acme-proxy

‎ansible/playbooks/uninstall.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
- name: Uninstall acme-proxy
3+
hosts: all
4+
become: true
5+
6+
vars:
7+
acme_proxy_install_dir: /opt/acme-proxy
8+
acme_proxy_service_user: acme-proxy
9+
acme_proxy_service_group: acme-proxy
10+
11+
tasks:
12+
- name: Stop and disable acme-proxy service
13+
ansible.builtin.systemd:
14+
name: acme-proxy
15+
state: stopped
16+
enabled: false
17+
ignore_errors: true
18+
19+
- name: Remove systemd service file
20+
ansible.builtin.file:
21+
path: /etc/systemd/system/acme-proxy.service
22+
state: absent
23+
24+
- name: Reload systemd daemon
25+
ansible.builtin.systemd:
26+
daemon_reload: true
27+
28+
- name: Clear failed state for acme-proxy
29+
ansible.builtin.command:
30+
cmd: systemctl reset-failed acme-proxy
31+
register: reset_failed_result
32+
failed_when: false
33+
changed_when: reset_failed_result.rc == 0
34+
35+
- name: Remove installation directory
36+
ansible.builtin.file:
37+
path: "{{ acme_proxy_install_dir }}"
38+
state: absent
39+
40+
- name: Remove service user
41+
ansible.builtin.user:
42+
name: "{{ acme_proxy_service_user }}"
43+
state: absent
44+
45+
- name: Remove service group
46+
ansible.builtin.group:
47+
name: "{{ acme_proxy_service_group }}"
48+
state: absent
49+
when: acme_proxy_service_user != acme_proxy_service_group

‎ansible/roles/acme-proxy/defaults/main.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
# Installation paths
3+
acme_proxy_version: latest
4+
acme_proxy_install_dir: /opt/acme-proxy
5+
acme_proxy_db_dir: "{{ acme_proxy_install_dir }}/db"
6+
acme_proxy_config_file: "{{ acme_proxy_install_dir }}/ca.json"
7+
8+
# Service account
9+
acme_proxy_service_user: acme-proxy
10+
acme_proxy_service_group: acme-proxy
11+
12+
# Listener
13+
acme_proxy_address: ":443"
14+
acme_proxy_dns_names:
15+
#- acme-proxy.example.com
16+
acme_proxy_common_name: "{{ acme_proxy_dns_names | first }}"
17+
18+
# Logging
19+
acme_proxy_log_format: json
20+
21+
# Upstream ACME CA — must be set for the service to function
22+
acme_proxy_ca_url: ""
23+
acme_proxy_account_email: ""
24+
acme_proxy_eab_kid: ""
25+
acme_proxy_eab_hmac_key: ""
26+
27+
# Metrics
28+
acme_proxy_metrics_enabled: true
29+
acme_proxy_metrics_port: 9234
30+
31+
# TLS
32+
acme_proxy_tls_min_version: 1.2
33+
acme_proxy_tls_max_version: 1.3
34+
acme_proxy_tls_renegotiation: false
35+
36+
# Systemd service state
37+
acme_proxy_service_enabled: true
38+
acme_proxy_service_state: started

‎ansible/roles/acme-proxy/handlers/main.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
- name: reload systemd daemon
3+
ansible.builtin.systemd:
4+
daemon_reload: true
5+
6+
- name: restart acme-proxy
7+
ansible.builtin.systemd:
8+
name: acme-proxy
9+
state: restarted

‎ansible/roles/acme-proxy/meta/main.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
galaxy_info:
3+
author: esnet
4+
description: Install and configure acme-proxy (step-ca ACME proxy server)
5+
license: Apache-2.0
6+
min_ansible_version: "2.14"
7+
platforms:
8+
- name: EL
9+
versions:
10+
- "8"
11+
- "9"
12+
- name: Ubuntu
13+
versions:
14+
- jammy
15+
- noble
16+
- name: Debian
17+
versions:
18+
- bullseye
19+
- bookworm
20+
21+
dependencies: []

‎ansible/roles/acme-proxy/tasks/binary.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
- name: Resolve latest release tag from GitHub
3+
ansible.builtin.uri:
4+
url: https://api.github.com/repos/esnet/acme-proxy/releases/latest
5+
return_content: true
6+
register: _acme_proxy_release_info
7+
when: acme_proxy_version == 'latest'
8+
9+
- name: Set resolved version fact
10+
ansible.builtin.set_fact:
11+
_acme_proxy_resolved_version: >-
12+
{{ _acme_proxy_release_info.json.tag_name
13+
if acme_proxy_version == 'latest'
14+
else acme_proxy_version }}
15+
16+
- name: Read installed version file
17+
ansible.builtin.slurp:
18+
src: "{{ acme_proxy_install_dir }}/.version"
19+
register: _acme_proxy_version_file
20+
ignore_errors: true
21+
22+
- name: Download acme-proxy binary
23+
ansible.builtin.get_url:
24+
url: >-
25+
https://github.com/esnet/acme-proxy/releases/download/{{ _acme_proxy_resolved_version }}/step-ca_{{ ansible_system | lower }}_{{ _acme_proxy_arch }}
26+
dest: "{{ acme_proxy_install_dir }}/step-ca"
27+
mode: "0755"
28+
owner: "{{ acme_proxy_service_user }}"
29+
group: "{{ acme_proxy_service_group }}"
30+
when: >-
31+
_acme_proxy_version_file.failed or
32+
(_acme_proxy_version_file.content | b64decode | trim) != _acme_proxy_resolved_version
33+
notify: restart acme-proxy
34+
35+
- name: Record installed version
36+
ansible.builtin.copy:
37+
content: "{{ _acme_proxy_resolved_version }}"
38+
dest: "{{ acme_proxy_install_dir }}/.version"
39+
mode: "0644"
40+
owner: "{{ acme_proxy_service_user }}"
41+
group: "{{ acme_proxy_service_group }}"

‎ansible/roles/acme-proxy/tasks/configure.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
- name: Deploy ca.json configuration
3+
ansible.builtin.template:
4+
src: ca.json.j2
5+
dest: "{{ acme_proxy_config_file }}"
6+
owner: "{{ acme_proxy_service_user }}"
7+
group: "{{ acme_proxy_service_group }}"
8+
mode: "0640"
9+
notify: restart acme-proxy

0 commit comments

Comments
 (0)