sshca: First version of role

playbooks/adm.yml

@@ -27,6 +27,7 @@
     - base
     - ansible_host
     - certbot
+    - sshca
     - role: keytab
       keytab_principals:
         - "host/{{ inventory_hostname }}@{{ kerberos_realm }}"

roles/sshca/files/signcert.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -eu
+
+umask 022
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $(basename "$0") <pubkey>" 1>&2
+    exit 1
+fi
+
+_basedir="/srv/sshca"
+_name="$1"
+
+if ! echo "$_name" | grep -Eq '.foo.sh$'; then
+    echo "ERROR: Only '*.foo.sh' certificates are allowed" 1>&2
+    exit 1
+fi
+
+if [ ! -f "/srv/ansible/facts/${_name}" ]; then
+    echo "ERROR: Cannot find host '${_name}'" 1>&2
+    exit 1
+fi
+
+ssh-keygen -s "${_basedir}/ca/ca" -I "$_name" -n "$_name" -V -5m:+365d -h \
+    "${_basedir}/pubkeys/${_name}.pub"

roles/sshca/tasks/main.yml

@@ -0,0 +1,36 @@
+---
+- name: Create datadirectories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+    owner: root
+    group: "{{ ansible_wheel }}"
+  with_items:
+    - /export/sshca
+    - /export/sshca/pubkeys
+
+- name: Create CA directory
+  ansible.builtin.file:
+    path: "/export/ssh/ca"
+    state: directory
+    mode: "0700"
+    owner: root
+    group: "{{ ansible_wheel }}"
+
+- name: Link datadirectory
+  ansible.builtin.file:
+    dest: /srv/sshca
+    src: /export/sshca
+    state: link
+    owner: root
+    group: "{{ ansible_wheel }}"
+    follow: false
+
+- name: Copy signing script
+  ansible.builtin.copy:
+    dest: /srv/sshca/signcert.sh
+    src: signcert.sh
+    mode: "0755"
+    owner: root
+    group: "{{ ansible_wheel }}"