infra/ansible/roles/consul_server/tasks/Debian.yml

123 lines
2.8 KiB
YAML
Raw Normal View History

2020-08-20 04:02:35 +00:00
---
2020-08-21 04:26:07 +00:00
- name: ensure consul group
group:
name: consul
state: present
system: True
- name: ensure consul user
user:
name: consul
state: present
group: consul
system: True
- name: ensure consul config dir
file:
path: /etc/consul.d/
state: directory
owner: consul
group: consul
mode: 0755
2020-10-13 01:59:24 +00:00
- name: ensure consul certs dir
2020-08-27 19:23:27 +00:00
file:
path: /etc/consul.d/certs/
state: directory
owner: consul
group: consul
mode: 0755
2020-08-27 19:23:27 +00:00
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/consul.d/certs/consul-server.pem"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
2020-08-27 19:23:27 +00:00
- name: get cert
2020-10-01 02:16:38 +00:00
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=server.{{ main_dc_name }}.{{ consul_domain }} alt_names=consul.service.{{ consul_domain }},consul.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
args:
executable: /bin/bash
environment:
2020-10-13 01:59:24 +00:00
VAULT_ADDR: http://vault.service.masked.name:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
2020-10-01 02:40:16 +00:00
notify: reload_consul
2020-08-27 19:23:27 +00:00
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/consul.d/certs/{{ item.path }}"
mode: '{{ item.mode }}'
2020-08-27 19:23:27 +00:00
owner: consul
group: consul
when: cert_data.changed
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "consul-server.pem",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "consul-server.key",
mode: "0600"
}
2020-08-27 19:23:27 +00:00
2020-08-21 04:26:07 +00:00
- name: ensure consul data dir
file:
path: /opt/consul
state: directory
owner: consul
group: consul
mode: 0755
2020-08-20 05:11:33 +00:00
- name: check consul version
shell:
cmd: "consul --version | head -1 | cut -d'v' -f2"
args:
executable: /bin/bash
changed_when: False
register: installed_consul_version
2020-08-27 19:23:27 +00:00
check_mode: False
2020-08-20 05:11:33 +00:00
2020-08-20 04:02:35 +00:00
- name: get consul
unarchive:
src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip"
dest: /usr/local/bin/
2020-08-20 05:11:33 +00:00
mode: 0755
owner: root
group: root
2020-08-21 04:26:07 +00:00
remote_src: True
2020-08-20 05:11:33 +00:00
when: installed_consul_version.stdout != consul_version
2020-08-21 04:26:07 +00:00
- name: copy consul unit file
copy:
src: files/consul.service
dest: /etc/systemd/system/consul.service
mode: 0755
owner: root
group: root
notify: daemon_reload
- name: template consul config
template:
src: templates/consul.hcl.j2
dest: /etc/consul.d/consul.hcl
owner: root
group: consul
mode: 0750
2020-08-21 04:26:07 +00:00
notify: restart_consul_debian
- name: ensure consul is started and enabled
systemd:
name: consul
state: started
enabled: True
...