119 lines
2.3 KiB
YAML
119 lines
2.3 KiB
YAML
- name: ensure ssh host certificates are signed
|
|
ssh_host_certs:
|
|
register: host_certs
|
|
tags:
|
|
- cert
|
|
|
|
- name: ensure sshd is configured to use host certificates
|
|
template:
|
|
src: hostcertificate.conf.j2
|
|
dest: /etc/ssh/sshd_config.d/10-hostcertificate.conf
|
|
mode: u=rw,go=r
|
|
owner: root
|
|
group: root
|
|
notify:
|
|
- reload sshd
|
|
tags:
|
|
- config
|
|
- sshd_config
|
|
|
|
- name: ensure dch-smallstep repo is configured
|
|
copy:
|
|
src: dch-smallstep.repo
|
|
dest: /etc/yum.repos.d/dch-smallstep.repo
|
|
mode: u=rw,go=r
|
|
owner: root
|
|
group: root
|
|
tags:
|
|
- yumrepo
|
|
|
|
- name: ensure step-cli is installed
|
|
package:
|
|
name: step-cli
|
|
state: present
|
|
tags:
|
|
- install
|
|
|
|
- name: ensure step certificate directory exists
|
|
file:
|
|
path: '{{ step_root_ca_path | dirname }}'
|
|
mode: u=rwx,go=rx
|
|
owner: root
|
|
group: root
|
|
state: directory
|
|
tags:
|
|
- cert
|
|
- name: ensure step root ca is installed
|
|
copy:
|
|
src: '{{ step_root_ca }}'
|
|
dest: '{{ step_root_ca_path }}'
|
|
mode: u=rw,go=r
|
|
owner: root
|
|
group: root
|
|
tags:
|
|
- cert
|
|
|
|
- name: ensure step-ssh-renew systemd units are installed
|
|
copy:
|
|
src: '{{ item }}'
|
|
dest: /etc/systemd/system/{{ item }}
|
|
mode: u=rw,go=r
|
|
owner: root
|
|
group: root
|
|
loop:
|
|
- step-ssh-renew@.service
|
|
- step-ssh-renew.target
|
|
- step-ssh-renew.timer
|
|
tags:
|
|
- systemd
|
|
|
|
- name: ensure step-ssh-renew environment variables are set
|
|
template:
|
|
src: step-ssh-renew.env.j2
|
|
dest: /etc/sysconfig/step-ssh-renew
|
|
mode: u=rw,go=r
|
|
owner: root
|
|
group: root
|
|
tags:
|
|
- config
|
|
- step-cli-config
|
|
|
|
- name: ensure step-ssh-renew.timer is enabled
|
|
systemd:
|
|
name: step-ssh-renew.timer
|
|
enabled: true
|
|
tags:
|
|
- service
|
|
- name: ensure step-ssh-renew.timer is running
|
|
systemd:
|
|
name: step-ssh-renew.timer
|
|
state: started
|
|
tags:
|
|
- service
|
|
|
|
- name: ensure sshd is configured to trust user certificate ca
|
|
copy:
|
|
src: trustedusercakeys.conf
|
|
dest: /etc/ssh/sshd_config.d/70-trustedusercakeys.conf
|
|
mode: u=rw,go=r
|
|
owner: root
|
|
group: root
|
|
tags:
|
|
- config
|
|
- sshd-config
|
|
notify:
|
|
- reload sshd
|
|
|
|
- name: ensure user ssh ca certificates are trusted
|
|
template:
|
|
src: ca.pub.j2
|
|
dest: /etc/ssh/ca.pub
|
|
mode: u=rw,go=r
|
|
owner: root
|
|
group: root
|
|
tags:
|
|
- config
|
|
- sshd-config
|
|
notify:
|
|
- reload sshd
|