bk-dss: new role to be deployed on LDAP host

This commit is contained in:
Markus 2018-10-15 18:25:30 +02:00
parent 32f976a163
commit 22c1b0d469
10 changed files with 157 additions and 0 deletions

View File

@ -2,6 +2,8 @@
certmgr_mode: webserver certmgr_mode: webserver
dss_domain: dss.binary-kitchen.de
gogs_domain: git.binary-kitchen.de gogs_domain: git.binary-kitchen.de
gogs_dbname: gogs gogs_dbname: gogs
gogs_dbuser: gogs gogs_dbuser: gogs

View File

@ -0,0 +1,3 @@
---
dss_uwsgi_port: 5001

View File

@ -0,0 +1,10 @@
---
- name: Run certmgr
command: /opt/acertmgr/acertmgr.py
- name: Restart nginx
service: name=nginx state=restarted
- name: Restart uwsgi
service: name=uwsgi state=restarted

View File

@ -0,0 +1,5 @@
---
dependencies:
- { role: certmgr }
- { role: nginx, nginx_ssl: True }

View File

@ -0,0 +1,43 @@
---
- name: Install dependencies
apt: name={{ item }}
with_items:
- git
- python3-flask
- python3-flaskext.wtf
- python3-passlib
- python3-pyldap
- python3-redis
- redis-server
- uwsgi
- uwsgi-plugin-python3
- name: Install bk-dss
git: repo=https://git.binary-kitchen.de/moepman/bk-dss.git dest=/opt/bk-dss depth=1 version=187bfe4f42f28f45e745ca4b1f8325d8622cec16
- name: Configure bk-dss
template: src=config.cfg.j2 dest=/opt/bk-dss/config.cfg
- name: Configure uwsgi
template: src=uwsgi.ini.j2 dest=/etc/uwsgi/apps-available/dss.ini
- name: Enable uwsgi
file: src=/etc/uwsgi/apps-available/dss.ini dest=/etc/uwsgi/apps-enabled/dss.ini state=link
notify: Restart uwsgi
- name: Ensure certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/dss.binary-kitchen.de.key -out /etc/nginx/ssl/dss.binary-kitchen.de.crt -days 730 -subj "/CN=dss.binary-kitchen.de" creates=/etc/nginx/ssl/dss.binary-kitchen.de.crt
notify: Restart nginx
- name: Configure certificate manager
template: src=certs.j2 dest=/etc/acme/domains.d/{{ dss_domain }}.conf
notify: Run certmgr
- name: Configure vhosts
template: src=vhost.j2 dest=/etc/nginx/sites-available/dss
notify: Restart nginx
- name: Enable vhosts
file: src=/etc/nginx/sites-available/dss dest=/etc/nginx/sites-enabled/dss state=link
notify: Restart nginx

View File

@ -0,0 +1,15 @@
---
{{ dss_domain }}:
- path: /etc/nginx/ssl/{{ dss_domain }}.crt
user: root
group: root
perm: '400'
format: crt,ca
action: '/usr/sbin/service nginx restart'
- path: /etc/nginx/ssl/{{ dss_domain }}.key
user: root
group: root
perm: '400'
format: key
action: '/usr/sbin/service nginx restart'

View File

@ -0,0 +1,34 @@
DEBUG = True
SECRET_KEY = "CHANGE!ME"
SESSION_TIMEOUT = 3600
LDAP_CA = "/etc/ldap/ssl/BKCA.crt"
LDAP_URI = "ldaps://{{ ldap_host }}"
LDAP_BASE = "{{ ldap_base }}"
ADMINS = [ "cn=moepman,ou=people,dc=binary-kitchen,dc=de", "cn=Manager,dc=binary-kitchen,dc=de" ]
USER_DN = "cn={user},ou=people,dc=binary-kitchen,dc=de"
USER_ATTRS = {
'objectClass' : ['top', 'inetOrgPerson', 'organizationalPerson', 'person', 'posixAccount', 'kitchenUser', 'radiusprofile', 'sambaSamAccount'],
'cn' : '{user}',
'gidNumber' : '20000',
'givenName' : '{gn}',
'homeDirectory' : '/home/{user}',
'loginShell' : '/bin/bash',
'mail' : '{user}@binary-kitchen.de',
'radiusTunnelMediumType' : '802',
'radiusTunnelPrivateGroupId' : '2303',
'radiusTunnelType' : 'VLAN',
'sambaSID' : 'S-1-0-0-{uid}',
'sn' : '{sn}',
'uid' : '{user}',
'uidNumber' : '{uid}',
'userPassword' : '{pass}'
}
GROUP_DN = 'cn=members,ou=groups,dc=binary-kitchen,dc=de'
REDIS_HOST = "127.0.0.1"
REDIS_PASSWD = None

View File

@ -0,0 +1,10 @@
[uwsgi]
socket = 127.0.0.1:{{ dss_uwsgi_port }}
chdir = /opt/bk-dss
plugin = python3
wsgi-file = dss.py
callable = app
uid = www-data
gid = www-data
processess = 4
threads = 2

View File

@ -0,0 +1,34 @@
server {
listen 80;
listen [::]:80;
server_name {{ dss_domain }};
location /.well-known/acme-challenge {
default_type "text/plain";
alias /var/www/acme-challenge;
}
location / {
return 301 https://{{ dss_domain }}$request_uri;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ dss_domain }};
ssl_certificate_key /etc/nginx/ssl/dss.binary-kitchen.de.key;
ssl_certificate /etc/nginx/ssl/dss.binary-kitchen.de.crt;
location / {
uwsgi_pass 127.0.0.1:{{ dss_uwsgi_port }};
include uwsgi_params;
}
location /static {
root /opt/bk-dss;
}
}

View File

@ -40,6 +40,7 @@
hosts: helium.binary-kitchen.net hosts: helium.binary-kitchen.net
roles: roles:
- slapd - slapd
- bk-dss
- name: Setup mail server - name: Setup mail server
hosts: lithium.binary-kitchen.net hosts: lithium.binary-kitchen.net