From dcd97881b482f0111a3a0cffe42cf500698eb83f Mon Sep 17 00:00:00 2001
From: Bo-Chun Louis Chen <louistw@uab.edu>
Date: Fri, 6 Dec 2024 13:08:36 -0600
Subject: [PATCH] feat: add ssl_cert role
---
ansible/cluster.yml | 1 +
ansible/roles/ssl_cert/tasks/main.yaml | 46 ++++++++++++++++++++++++++
2 files changed, 47 insertions(+)
create mode 100644 ansible/roles/ssl_cert/tasks/main.yaml
diff --git a/ansible/cluster.yml b/ansible/cluster.yml
index a131e1e..9d4eaa3 100644
--- a/ansible/cluster.yml
+++ b/ansible/cluster.yml
@@ -9,4 +9,5 @@
- { name: 'slurm_client', tags: 'slurm_client', when: enable_slurm_client }
- { name: 'ssh_host_keys', tags: 'ssh_host_keys' }
- { name: 'ssh_proxy_config', tags: 'ssh_proxy_config', when: enable_ssh_proxy_config }
+ - { name: 'ssl_cert', tags: 'ssl_cert' }
- { name: 'rsyslog_config', tags: 'rsyslog_config', when: enable_rsyslog_config }
diff --git a/ansible/roles/ssl_cert/tasks/main.yaml b/ansible/roles/ssl_cert/tasks/main.yaml
new file mode 100644
index 0000000..7458957
--- /dev/null
+++ b/ansible/roles/ssl_cert/tasks/main.yaml
@@ -0,0 +1,46 @@
+---
+- name: Download SSL Certs from S3
+ aws_s3:
+ mode: get
+ s3_url: "{{ S3_ENDPOINT }}"
+ bucket: "{{ ssl_cert_s3_bucket }}"
+ object: "{{ item }}"
+ dest: "{{ ssl_cert_file_location }}/{{ item }}"
+ aws_access_key: "{{ LTS_ACCESS_KEY }}"
+ aws_secret_key: "{{ LTS_SECRET_KEY }}"
+ vars:
+ ansible_python_interpreter: /usr/bin/python3
+ when: ssl_cert_s3_bucket | length > 0 and item | length > 0
+ loop:
+ - "{{ ssl_cert_file }}"
+ - "{{ ssl_cert_chain_file }}"
+
+- name: Download SSL key from S3
+ aws_s3:
+ mode: get
+ s3_url: "{{ S3_ENDPOINT }}"
+ bucket: "{{ ssl_cert_s3_bucket }}"
+ object: "{{ ssl_cert_key }}"
+ dest: "{{ ssl_cert_key_location }}/{{ ssl_cert_key }}"
+ aws_access_key: "{{ LTS_ACCESS_KEY }}"
+ aws_secret_key: "{{ LTS_SECRET_KEY }}"
+ vars:
+ ansible_python_interpreter: /usr/bin/python3
+ when: ssl_cert_s3_bucket | length > 0 and ssl_cert_key | length > 0
+
+- name: Update SSL in Apache config
+ ansible.builtin.replace:
+ path: "{{ ssl_apache_config }}"
+ regexp: "{{ item.regexp }}"
+ replace: "\\1 {{ item.location }}/{{ item.value }}"
+ backup: true
+ when: ssl_apache_config | length > 0 and item.value | length > 0
+ loop:
+ - { regexp: "#?(SSLCertificateFile).*$", location: "{{ ssl_cert_file_location }}", value: "{{ ssl_cert_file }}" }
+ - { regexp: "#?(SSLCertificateChainFile).*$", location: "{{ ssl_cert_file_location }}", value: "{{ ssl_cert_chain_file }}" }
+ - { regexp: "#?(SSLCertificateKeyFile).*$", location: "{{ ssl_cert_key_location }}", value: "{{ ssl_cert_key }}" }
+
+- name: Restart apache service
+ ansible.builtin.service:
+ name: "{{ apache_service }}"
+ state: restarted
--
GitLab