blob: 905ed888711b263e19376002a2eeff5ee37c9262 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
- name: Determine SSH keys generated by this machine
find: paths=/etc/ssh
file_type=file
patterns="ssh_host_*_key"
register: ssh_key_files
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
- name: Determine SSH keys never signed
stat: path="{{item.path}}-cert.pub"
with_items: "{{ssh_key_files.files}}"
register: ssh_cert_files
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
- name: Set lists of certs to sign to empty
set_fact:
certs_to_sign: "[]"
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
- name: Set list of certs to sign
set_fact:
certs_to_sign: "{{certs_to_sign}} + [ '{{item.item.path}}' ]"
with_items: "{{ssh_cert_files.results}}"
when: env == "staging" and not item.stat.exists
tags:
- sshd_config
- config
- sshd
- base
# TODO: Get expired certificates, and add them to certs_to_sign
- set_fact:
pubkeydir: "/tmp/sshkeysign"
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
- name: Create directory for storing pubkeys
file: path="{{pubkeydir}}"
owner=root
group=root
mode=0600
state=directory
delegate_to: "batcave01.phx2.fedoraproject.org"
run_once: true
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
- name: Get public keys for certs to sign
fetch: src="{{item}}.pub"
dest="{{pubkeydir}}"
fail_on_missing=true
with_items: "{{certs_to_sign}}"
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
- name: Set some extra signing facts
set_fact:
sign_hostnames: "{{ssh_hostnames}} + ['{{inventory_hostname}}']"
sign_validity: "-1h:+52w"
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
# Currently, we use the epoch as serial. That's unique enough for now
- name: Sign the certificates
command: "ssh-keygen -s {{private}}/files/ssh/staging_ca_host_key -I {{inventory_hostname}} -h -n {{ sign_hostnames|join(',') }} -V {{sign_validity}} -z {{ansible_date_time.epoch}} {{pubkeydir}}/{{inventory_hostname}}{{item}}.pub"
delegate_to: "batcave01.phx2.fedoraproject.org"
with_items: "{{certs_to_sign}}"
when: env == "staging"
tags:
- sshd_config
- config
- sshd
- base
- name: Copy the certificates
copy: src="{{pubkeydir}}/{{inventory_hostname}}{{item}}-cert.pub"
dest="{{item}}-cert.pub"
with_items: "{{certs_to_sign}}"
when: env == "staging"
notify:
- restart sshd
tags:
- sshd_config
- config
- sshd
- base
|
