120 lines
2.9 KiB
YAML
120 lines
2.9 KiB
YAML
|
---
|
||
|
|
- name: check if server cert is expiring in the next 5 days
|
||
|
|
shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/nexus.crt"
|
||
|
|
args:
|
||
|
|
executable: /bin/bash
|
||
|
|
failed_when: False
|
||
|
|
check_mode: False
|
||
|
|
changed_when: False
|
||
|
|
register: exp
|
||
|
|
|
||
|
|
- name: get cert
|
||
|
|
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nexus.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
|
||
|
|
args:
|
||
|
|
executable: /bin/bash
|
||
|
|
environment:
|
||
|
|
VAULT_ADDR: http://ivyking.minhas.io:8200
|
||
|
|
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
|
||
|
|
VAULT_FORMAT: json
|
||
|
|
register: cert_data
|
||
|
|
when: exp.rc != 0
|
||
|
|
|
||
|
|
- name: write cert data to server
|
||
|
|
copy:
|
||
|
|
content: "{{ item.content }}"
|
||
|
|
dest: "/etc/pki/{{ item.path }}"
|
||
|
|
mode: '{{ item.mode }}'
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
when: cert_data.changed
|
||
|
|
loop:
|
||
|
|
- {
|
||
|
|
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
|
||
|
|
path: "certs/nexus.crt",
|
||
|
|
mode: "0755"
|
||
|
|
}
|
||
|
|
- {
|
||
|
|
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
|
||
|
|
path: "keys/nexus.key",
|
||
|
|
mode: "0600"
|
||
|
|
}
|
||
|
|
- name: ensure python-docker is installed
|
||
|
|
apt:
|
||
|
|
name: python3-docker
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: ensure nexus group exists
|
||
|
|
group:
|
||
|
|
name: nexus
|
||
|
|
state: present
|
||
|
|
gid: 200
|
||
|
|
|
||
|
|
- name: ensure nexus user exists
|
||
|
|
user:
|
||
|
|
name: nexus
|
||
|
|
group: nexus
|
||
|
|
uid: 200
|
||
|
|
create_home: False
|
||
|
|
|
||
|
|
- name: ensure nexus ssl dir exists
|
||
|
|
file:
|
||
|
|
path: /etc/nexus/
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: 0755
|
||
|
|
|
||
|
|
- name: ensure nexus data dir exists
|
||
|
|
file:
|
||
|
|
path: "{{ nexus_storage }}"
|
||
|
|
state: directory
|
||
|
|
owner: nexus
|
||
|
|
group: nexus
|
||
|
|
mode: 0755
|
||
|
|
|
||
|
|
- name: ensure nexus data dir exists
|
||
|
|
file:
|
||
|
|
path: "{{ nexus_config_dir }}"
|
||
|
|
state: directory
|
||
|
|
owner: nexus
|
||
|
|
group: nexus
|
||
|
|
mode: 0755
|
||
|
|
|
||
|
|
- name: ensure nexus keystore dir exists
|
||
|
|
file:
|
||
|
|
path: "{{ nexus_config_dir }}/etc/ssl/"
|
||
|
|
state: directory
|
||
|
|
owner: nexus
|
||
|
|
group: nexus
|
||
|
|
mode: 0755
|
||
|
|
|
||
|
|
- name: ensure keystore exists
|
||
|
|
copy:
|
||
|
|
content: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['keystore'] | b64decode }}"
|
||
|
|
dest: "{{ nexus_config_dir }}/etc/ssl/keystore.jks"
|
||
|
|
owner: nexus
|
||
|
|
group: nexus
|
||
|
|
mode: 0700
|
||
|
|
|
||
|
|
- name: template nexus.properties
|
||
|
|
template:
|
||
|
|
src: templates/nexus.properties.j2
|
||
|
|
dest: "{{ nexus_storage }}/etc/nexus.properties"
|
||
|
|
|
||
|
|
- name: run nexus3
|
||
|
|
docker_container:
|
||
|
|
name: nexus
|
||
|
|
image: sonatype/nexus3
|
||
|
|
env:
|
||
|
|
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/nexus.crt
|
||
|
|
REGISTRY_HTTP_TLS_KEY: /certs/nexus.key
|
||
|
|
REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['REGISTRY_HTTP_SECRET'] }}"
|
||
|
|
ports:
|
||
|
|
- "8081:8081"
|
||
|
|
volumes:
|
||
|
|
- "{{ nexus_storage }}:/nexus-data"
|
||
|
|
- "{{ nexus_config_dir }}/etc/ssl:/opt/sonatype/nexus/etc/ssl/"
|
||
|
|
- /etc/nexus:/certs
|
||
|
|
restart_policy: always
|
||
|
|
...
|