Solutions

1. Git en mode Ad-hoc

ansible localhost -m git -a "repo=https://github.com/goffinet/guide-ansible-playbooks dest=/home/userlab/guide-ansible-playbooks"

2. Certificats TLS auto-signés

Solution 1 : Module command

Voici une solution fonctionnelle avec le module command mais elle est “brut de décoffrage”.

- name: Install nginx and python-openssl
  apt:
    name:
      - nginx
      - python-openssl
    update_cache: yes
    cache_valid_time: 3600

- name: Create self-signed certificate, if configured.
  command: >
    openssl req -x509 -nodes -subj '/CN=localhost' -days 365
    -newkey rsa:4096 -sha256 -keyout {{ key_file }} -out {{ cert_file }}
    creates={{ cert_file }}
  notify: restart nginx

- name: "fix right on key file"
  file:
    name: "{{ key_file }}"
    mode: 0600
  notify: restart nginx

Solution 2 : Modules openssl_*

Voici une solution avec des variables et des tâches idempotentes grâce aux modules Ansibles openssl_* :

  • openssl_privatekey
  • openssl_csr
  • openssl_certificate
  • openssl_dhparam

Variables

vars:
  key_file: "/path/{{ ansible_fqdn }}.key.pem"
  csr_file: "/path/{{ ansible_fqdn }}.csr.pem"
  cert_file: "/path/{{ ansible_fqdn }}.cert.pem"
  dh_file: "/path/{{ ansible_fqdn }}.dh.pem"

Tâches

- name: Generate an OpenSSL private key.
  openssl_privatekey:
    path: "{{ key_file }}"
  notify: restart nginx

- name: Generate an OpenSSL CSR.
  openssl_csr:
    path: "{{ csr_file }}"
    privatekey_path: "{{ key_file }}"
    common_name: "{{ ansible_fqdn }}"
  notify: restart nginx

- name: Generate a Self Signed OpenSSL certificate.
  openssl_certificate:
    path: "{{ cert_file }}"
    privatekey_path: "{{ key_file }}"
    csr_path: "{{ csr_file }}"
    provider: selfsigned
  notify: restart nginx

- name: "fix right on key file"
  file:
    name: "{{ key_file }}"
    mode: 0600
  notify: restart nginx

Pour générer un fichier Diffie-Helman (DH) :

- name: "generate a DH key"
  openssl_dhparam:
    path: "{{ dh_file }}"
    size: 2048

Test

Loading…