88 lines
2.2 KiB
YAML
88 lines
2.2 KiB
YAML
---
|
|
- name: install packages
|
|
package:
|
|
name: "{{ item }}"
|
|
state: installed
|
|
with_items:
|
|
- krb5-server
|
|
- krb5-server-ldap
|
|
- python-kdcproxy
|
|
|
|
- name: create kerberos config
|
|
template:
|
|
dest: /var/kerberos/krb5kdc/kdc.conf
|
|
src: kdc.conf.j2
|
|
mode: 0600
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
notify: restart kdc
|
|
|
|
- name: store kdc and kadmin ldap auth credentials
|
|
shell: "( echo '{{ kerberos_kdc_pass }}' ; echo '{{ kerberos_kdc_pass }}' ) | kdb5_ldap_util stashsrvpw uid=krb5kdc,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }} ; ( echo '{{ kerberos_kadmin_pass }}' ; echo '{{ kerberos_kadmin_pass }}' ) | kdb5_ldap_util stashsrvpw uid=krb5kadmin,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }}"
|
|
args:
|
|
creates: "/var/kerberos/krb5kdc/.k5.ldap.{{ kerberos_realm|lower() }}"
|
|
no_log: true
|
|
|
|
- name: store kdc master key
|
|
shell: "echo '{{ kerberos_master_pass }}' | kdb5_util stash"
|
|
args:
|
|
creates: "/var/kerberos/krb5kdc/.k5.{{ kerberos_realm }}"
|
|
no_log: true
|
|
|
|
- name: enable kerberos service
|
|
service:
|
|
name: krb5kdc
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: create kdcproxy group
|
|
group:
|
|
name: kdcproxy
|
|
system: true
|
|
|
|
- name: create kdcproxy user
|
|
user:
|
|
name: kdcproxy
|
|
comment: KDC Proxy
|
|
group: kdcproxy
|
|
groups: gunicorn
|
|
home: /var/empty
|
|
shell: /sbin/nologin
|
|
system: true
|
|
|
|
- name: add nginx to kdcproxy group
|
|
user:
|
|
name: nginx
|
|
groups: kdcproxy
|
|
|
|
- name: create kdcproxy config
|
|
template:
|
|
dest: /etc/kdcproxy.conf
|
|
src: kdcproxy.conf.j2
|
|
mode: 0644
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
|
|
- name: create kdcproxy socket file
|
|
copy:
|
|
dest: /lib/systemd/system/gunicorn@kdcproxy.socket
|
|
src: /lib/systemd/system/gunicorn@.socket
|
|
mode: 0644
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
remote_src: true
|
|
|
|
- name: enable kdcproxy socket
|
|
systemd:
|
|
name: gunicorn@kdcproxy.socket
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: create kdcproxy config for nginx
|
|
template:
|
|
dest: "/etc/nginx/conf.d/{{ inventory_hostname }}/kdcproxy.conf"
|
|
src: nginx-kdcproxy.conf.j2
|
|
mode: 0644
|
|
owner: root
|
|
group: "{{ ansible_wheel }}"
|
|
notify: restart nginx
|