Compare commits
No commits in common. "dce8d35fe4f347d96e0ccc4a4109324c3103be11" and "eca78a092d0dc12bf03e17b123a6340443d738d1" have entirely different histories.
dce8d35fe4
...
eca78a092d
9 changed files with 0 additions and 136 deletions
|
@ -3,16 +3,6 @@
|
||||||
systemd:
|
systemd:
|
||||||
daemon_reload: True
|
daemon_reload: True
|
||||||
|
|
||||||
- name: reload_consul_debian
|
|
||||||
systemd:
|
|
||||||
name: consul
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
- name: reload_consul_fbsd
|
|
||||||
service:
|
|
||||||
name: consul
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
- name: restart_consul_debian
|
- name: restart_consul_debian
|
||||||
systemd:
|
systemd:
|
||||||
name: consul
|
name: consul
|
||||||
|
|
|
@ -47,7 +47,6 @@
|
||||||
VAULT_FORMAT: json
|
VAULT_FORMAT: json
|
||||||
register: cert_data
|
register: cert_data
|
||||||
when: exp.rc != 0
|
when: exp.rc != 0
|
||||||
notify: reload_consul
|
|
||||||
|
|
||||||
- name: write cert data to server
|
- name: write cert data to server
|
||||||
copy:
|
copy:
|
||||||
|
|
|
@ -47,7 +47,6 @@
|
||||||
VAULT_FORMAT: json
|
VAULT_FORMAT: json
|
||||||
register: cert_data
|
register: cert_data
|
||||||
when: exp.rc != 0
|
when: exp.rc != 0
|
||||||
notify: reload_consul
|
|
||||||
|
|
||||||
- name: write cert data to server
|
- name: write cert data to server
|
||||||
copy:
|
copy:
|
||||||
|
|
|
@ -3,11 +3,6 @@
|
||||||
systemd:
|
systemd:
|
||||||
daemon_reload: True
|
daemon_reload: True
|
||||||
|
|
||||||
- name: reload_nomad
|
|
||||||
systemd:
|
|
||||||
name: nomad
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
- name: restart_nomad
|
- name: restart_nomad
|
||||||
systemd:
|
systemd:
|
||||||
name: nomad
|
name: nomad
|
||||||
|
|
|
@ -85,55 +85,6 @@
|
||||||
group: nomad
|
group: nomad
|
||||||
remote_src: True
|
remote_src: True
|
||||||
|
|
||||||
- name: ensure nomad config dir
|
|
||||||
file:
|
|
||||||
path: /etc/nomad.d/certs/
|
|
||||||
state: directory
|
|
||||||
owner: nomad
|
|
||||||
group: nomad
|
|
||||||
mode: 0755
|
|
||||||
|
|
||||||
- name: check if server cert is expiring in the next 5 days
|
|
||||||
shell: "openssl x509 -checkend 432000 -noout -in /etc/nomad.d/certs/nomad.pem"
|
|
||||||
args:
|
|
||||||
executable: /bin/bash
|
|
||||||
failed_when: False
|
|
||||||
check_mode: False
|
|
||||||
changed_when: False
|
|
||||||
register: exp
|
|
||||||
|
|
||||||
- name: get cert
|
|
||||||
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nomad.service.{{ main_dc_name }}.{{ consul_domain }} alt_names=nomad.service.{{ consul_domain }} ttl=43200m"
|
|
||||||
args:
|
|
||||||
executable: /bin/bash
|
|
||||||
environment:
|
|
||||||
VAULT_ADDR: http://ivyking.minhas.io:8200
|
|
||||||
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
|
|
||||||
VAULT_FORMAT: json
|
|
||||||
register: cert_data
|
|
||||||
when: exp.rc != 0
|
|
||||||
notify: reload_nomad
|
|
||||||
|
|
||||||
- name: write cert data to server
|
|
||||||
copy:
|
|
||||||
content: "{{ item.content }}"
|
|
||||||
dest: "/etc/nomad.d/certs/{{ item.path }}"
|
|
||||||
mode: '{{ item.mode }}'
|
|
||||||
owner: nomad
|
|
||||||
group: nomad
|
|
||||||
when: cert_data.changed
|
|
||||||
loop:
|
|
||||||
- {
|
|
||||||
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
|
|
||||||
path: "nomad.pem",
|
|
||||||
mode: "0755"
|
|
||||||
}
|
|
||||||
- {
|
|
||||||
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
|
|
||||||
path: "nomad.key",
|
|
||||||
mode: "0600"
|
|
||||||
}
|
|
||||||
|
|
||||||
- name: ensure nomad is started and enabled
|
- name: ensure nomad is started and enabled
|
||||||
systemd:
|
systemd:
|
||||||
name: nomad
|
name: nomad
|
||||||
|
|
|
@ -9,14 +9,6 @@ consul {
|
||||||
token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-client'] }}"
|
token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-client'] }}"
|
||||||
}
|
}
|
||||||
|
|
||||||
tls {
|
|
||||||
http = true
|
|
||||||
rpc = true
|
|
||||||
ca_file = "/etc/pki/certs/{{ vault_ca_cert_name }}"
|
|
||||||
cert_file = "/etc/nomad.d/certs/nomad.pem"
|
|
||||||
key_file = "/etc/nomad.d/certs/nomad.key"
|
|
||||||
}
|
|
||||||
|
|
||||||
plugin_dir = "/opt/nomad_plugins"
|
plugin_dir = "/opt/nomad_plugins"
|
||||||
|
|
||||||
plugin "nomad-driver-podman" {
|
plugin "nomad-driver-podman" {
|
||||||
|
|
|
@ -3,11 +3,6 @@
|
||||||
systemd:
|
systemd:
|
||||||
daemon_reload: True
|
daemon_reload: True
|
||||||
|
|
||||||
- name: reload_nomad
|
|
||||||
systemd:
|
|
||||||
name: nomad
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
- name: restart_nomad
|
- name: restart_nomad
|
||||||
systemd:
|
systemd:
|
||||||
name: nomad
|
name: nomad
|
||||||
|
|
|
@ -65,55 +65,6 @@
|
||||||
mode: 0755
|
mode: 0755
|
||||||
notify: restart_nomad
|
notify: restart_nomad
|
||||||
|
|
||||||
- name: ensure nomad config dir
|
|
||||||
file:
|
|
||||||
path: /etc/nomad.d/certs/
|
|
||||||
state: directory
|
|
||||||
owner: nomad
|
|
||||||
group: nomad
|
|
||||||
mode: 0755
|
|
||||||
|
|
||||||
- name: check if server cert is expiring in the next 5 days
|
|
||||||
shell: "openssl x509 -checkend 432000 -noout -in /etc/nomad.d/certs/nomad.pem"
|
|
||||||
args:
|
|
||||||
executable: /bin/bash
|
|
||||||
failed_when: False
|
|
||||||
check_mode: False
|
|
||||||
changed_when: False
|
|
||||||
register: exp
|
|
||||||
|
|
||||||
- name: get cert
|
|
||||||
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nomad.service.{{ main_dc_name }}.{{ consul_domain }} alt_names=nomad.service.{{ consul_domain }} ttl=43200m"
|
|
||||||
args:
|
|
||||||
executable: /bin/bash
|
|
||||||
environment:
|
|
||||||
VAULT_ADDR: http://ivyking.minhas.io:8200
|
|
||||||
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
|
|
||||||
VAULT_FORMAT: json
|
|
||||||
register: cert_data
|
|
||||||
when: exp.rc != 0
|
|
||||||
notify: reload_nomad
|
|
||||||
|
|
||||||
- name: write cert data to server
|
|
||||||
copy:
|
|
||||||
content: "{{ item.content }}"
|
|
||||||
dest: "/etc/nomad.d/certs/{{ item.path }}"
|
|
||||||
mode: '{{ item.mode }}'
|
|
||||||
owner: nomad
|
|
||||||
group: nomad
|
|
||||||
when: cert_data.changed
|
|
||||||
loop:
|
|
||||||
- {
|
|
||||||
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
|
|
||||||
path: "nomad.pem",
|
|
||||||
mode: "0755"
|
|
||||||
}
|
|
||||||
- {
|
|
||||||
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
|
|
||||||
path: "nomad.key",
|
|
||||||
mode: "0600"
|
|
||||||
}
|
|
||||||
|
|
||||||
- name: ensure nomad is started and enabled
|
- name: ensure nomad is started and enabled
|
||||||
systemd:
|
systemd:
|
||||||
name: nomad
|
name: nomad
|
||||||
|
|
|
@ -9,11 +9,3 @@ server {
|
||||||
consul {
|
consul {
|
||||||
token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-server'] }}"
|
token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-server'] }}"
|
||||||
}
|
}
|
||||||
|
|
||||||
tls {
|
|
||||||
http = true
|
|
||||||
rpc = true
|
|
||||||
ca_file = "/etc/pki/certs/{{ vault_ca_cert_name }}"
|
|
||||||
cert_file = "/etc/nomad.d/certs/nomad.pem"
|
|
||||||
key_file = "/etc/nomad.d/certs/nomad.key"
|
|
||||||
}
|
|
||||||
|
|
Loading…
Reference in a new issue