infra/ansible/roles/docker-repo/tasks/main.yml

86 lines
2.1 KiB
YAML

---
- name: ensure docker repo cert directory exists
file:
path: /etc/docker-repo/certs
recurse: True
state: directory
owner: root
group: root
mode: 0755
- name: ensure docker data directory exists
file:
path: '{{ docker_repo_storage }}'
recurse: True
state: directory
owner: root
group: root
mode: 0755
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/docker-repo/certs/docker-repo.crt"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker-repo.service.masked.name ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: https://vault.service.masked.name:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/docker-repo/{{ item.path }}"
mode: '{{ item.mode }}'
owner: root
group: root
when: cert_data.changed
register: cert_written
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "certs/docker-repo.crt",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "certs/docker-repo.key",
mode: "0600"
}
- name: ensure python-docker is installed
apt:
name: python3-docker
state: present
- name: ensure docker repo data dir exists
file:
path: "{{ docker_repo_storage }}"
state: directory
mode: 0755
- name: run docker-repo
docker_container:
name: docker-repo
image: registry:2
env:
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker-repo.crt
REGISTRY_HTTP_TLS_KEY: /certs/docker-repo.key
ports:
- "5000:5000"
volumes:
- "{{ docker_repo_storage }}:/data"
- "/etc/docker-repo/certs:/certs"
restart_policy: always
...