Add nexus with ssl

ansible/group_vars/all/main.yml

@@ -3,7 +3,7 @@
 main_dc_name: columbia
 
 # consul
-consul_version: 1.8.3
+consul_version: 1.8.4
 consul_domain: masked.name
 
 # vault

ansible/host_vars/ivyking.minhas.io/main.yml

@@ -1,3 +1,4 @@
 ---
-docker_registry_mnt: /mnt/raid/docker_registry
+nexus_storage: /opt/nexus
+nexus_config_dir: /opt/nexus-config
 ...

ansible/inventory.txt

@@ -9,7 +9,7 @@ fatman.minhas.io
 ivyking.minhas.io
 sedan.minhas.io
 
-[docker_registry]
+[nexus]
 ivyking.minhas.io
 
 [nomad_client]

ansible/playbooks/docker-registry.yml

@@ -1,5 +0,0 @@
----
-- hosts: docker_registry
-  roles:
-    - role: docker_registry
-...

ansible/playbooks/docker.yml

@@ -1,5 +1,5 @@
 ---
-- hosts: docker_registry:nomad_client
+- hosts: nexus:nomad_client
   roles:
     - role: docker
 ...

ansible/playbooks/nexus.yml

@@ -0,0 +1,5 @@
+---
+- hosts: nexus
+  roles:
+    - role: nexus
+...

ansible/playbooks/site.yml

@@ -4,5 +4,5 @@
 - import_playbook: vault-server.yml
 - import_playbook: consul-client.yml
 - import_playbook: nomad.yml
-- import_playbook: docker-registry.yml
+- import_playbook: nexus.yml
 ...

ansible/roles/docker_registry/tasks/main.yml

@@ -1,96 +0,0 @@
----
-- name: check if server cert is expiring in the next 5 days
-  shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/docker_registry.crt"
-  args:
-    executable: /bin/bash
-  failed_when: False
-  check_mode: False
-  changed_when: False
-  register: exp
-
-- name: get cert
-  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
-  args:
-    executable: /bin/bash
-  environment:
-    VAULT_ADDR: http://ivyking.minhas.io:8200
-    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
-    VAULT_FORMAT: json
-  register: cert_data
-  when: exp.rc != 0
-
-- name: write cert data to server
-  copy:
-    content: "{{ item.content }}"
-    dest: "/etc/pki/{{ item.path }}"
-    mode: '{{ item.mode }}'
-    owner: root
-    group: root
-  when: cert_data.changed
-  loop:
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
-        path: "certs/docker_registry.crt",
-        mode: "0755"
-    }
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
-        path: "keys/docker_registry.key",
-        mode: "0600"
-    }
-- name: ensure python-docker is installed
-  apt:
-    name: python3-docker
-    state: present
-
-- name: ensure docker registry ssl dir
-  file:
-    path: /etc/docker_registry/
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
-
-- name: ensure docker registry cert
-  file:
-    state: hard
-    src: /etc/pki/certs/docker_registry.crt
-    dest: /etc/docker_registry/docker_registry.crt
-    owner: root
-    group: root
-    mode: 0644
-
-- name: ensure docker registry private key
-  file:
-    state: hard
-    src: /etc/pki/keys/docker_registry.key
-    dest: /etc/docker_registry/docker_registry.key
-    owner: root
-    group: root
-    mode: 0644
-
-- name: ensure docker registry key and cert are available
-  file:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    state: hard
-  loop:
-    - { src: /etc/pki/certs/docker_registry.crt, dest: /etc/docker_registry/docker_registry.crt }
-    - { src: /etc/pki/keys/docker_registry.key, dest: /etc/docker_registry/docker_registry.key }
-
-- name: run docker registry
-  docker_container:
-    name: registry
-    image: registry:2
-    env:
-      REGISTRY_HTTP_ADDR: 0.0.0.0:443
-      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker_registry.crt
-      REGISTRY_HTTP_TLS_KEY: /certs/docker_registry.key
-      REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/docker:data')['REGISTRY_HTTP_SECRET'] }}"
-    ports:
-      - "5000:443"
-    volumes:
-      - "{{ docker_registry_mnt }}:/var/lib/registry"
-      - "/etc/docker_registry:/certs"
-    restart_policy: always
-...

ansible/roles/nexus/tasks/main.yml

@@ -0,0 +1,119 @@
+---
+- name: check if server cert is expiring in the next 5 days
+  shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/nexus.crt"
+  args:
+    executable: /bin/bash
+  failed_when: False
+  check_mode: False
+  changed_when: False
+  register: exp
+
+- name: get cert
+  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nexus.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
+  args:
+    executable: /bin/bash
+  environment:
+    VAULT_ADDR: http://ivyking.minhas.io:8200
+    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
+    VAULT_FORMAT: json
+  register: cert_data
+  when: exp.rc != 0
+
+- name: write cert data to server
+  copy:
+    content: "{{ item.content }}"
+    dest: "/etc/pki/{{ item.path }}"
+    mode: '{{ item.mode }}'
+    owner: root
+    group: root
+  when: cert_data.changed
+  loop:
+    - {
+        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
+        path: "certs/nexus.crt",
+        mode: "0755"
+    }
+    - {
+        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
+        path: "keys/nexus.key",
+        mode: "0600"
+    }
+- name: ensure python-docker is installed
+  apt:
+    name: python3-docker
+    state: present
+
+- name: ensure nexus group exists
+  group:
+    name: nexus
+    state: present
+    gid: 200
+
+- name: ensure nexus user exists
+  user:
+    name: nexus
+    group: nexus
+    uid: 200
+    create_home: False
+
+- name: ensure nexus ssl dir exists
+  file:
+    path: /etc/nexus/
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
+
+- name: ensure nexus data dir exists
+  file:
+    path: "{{ nexus_storage }}"
+    state: directory
+    owner: nexus
+    group: nexus
+    mode: 0755
+
+- name: ensure nexus data dir exists
+  file:
+    path: "{{ nexus_config_dir }}"
+    state: directory
+    owner: nexus
+    group: nexus
+    mode: 0755
+
+- name: ensure nexus keystore dir exists
+  file:
+    path: "{{ nexus_config_dir }}/etc/ssl/"
+    state: directory
+    owner: nexus
+    group: nexus
+    mode: 0755
+
+- name: ensure keystore exists
+  copy:
+    content: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['keystore'] | b64decode }}"
+    dest: "{{ nexus_config_dir }}/etc/ssl/keystore.jks"
+    owner: nexus
+    group: nexus
+    mode: 0700
+
+- name: template nexus.properties
+  template:
+    src: templates/nexus.properties.j2
+    dest: "{{ nexus_storage }}/etc/nexus.properties"
+
+- name: run nexus3
+  docker_container:
+    name: nexus
+    image:  sonatype/nexus3
+    env:
+      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/nexus.crt
+      REGISTRY_HTTP_TLS_KEY: /certs/nexus.key
+      REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['REGISTRY_HTTP_SECRET'] }}"
+    ports:
+      - "8081:8081"
+    volumes:
+      - "{{ nexus_storage }}:/nexus-data"
+      - "{{ nexus_config_dir }}/etc/ssl:/opt/sonatype/nexus/etc/ssl/"
+      - /etc/nexus:/certs
+    restart_policy: always
+...

ansible/roles/nexus/templates/nexus.properties.j2

@@ -0,0 +1,13 @@
+# Jetty section
+application-port-ssl=8081
+application-port=8082
+application-host=0.0.0.0
+nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-https.xml,${jetty.etc}/jetty-requestlog.xml
+ssl.etc=/opt/sonatype/nexus/etc/ssl/
+# nexus-context-path=/${NEXUS_CONTEXT}
+
+# Nexus section
+# nexus-edition=nexus-pro-edition
+# nexus-features=\
+#  nexus-pro-feature
+# nexus.clustered=false