forked from infra/ansible
57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
---
|
|
|
|
- name: Install radius server
|
|
apt: name=freeradius
|
|
|
|
- name: Ensure certificates are available
|
|
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/freeradius/3.0/certs/srv.key -out /etc/freeradius/3.0/certs/srv.crt -days 730 -subj "/CN={{ ansible_fqdn }}" creates=/etc/freeradius/3.0/certs/srv.crt
|
|
notify: Restart freeradius
|
|
|
|
- name: Ensure correct certificate permissions
|
|
file: path=/etc/freeradius/3.0/certs/srv.key owner=freerad mode=0400
|
|
notify: Restart freeradius
|
|
|
|
- name: Request nsupdate key for certificate
|
|
include_role: name=acme-dnskey-generate
|
|
vars:
|
|
acme_dnskey_san_domains:
|
|
- "{{ radius_hostname }}"
|
|
- "{{ radius_cn }}"
|
|
|
|
- name: Configure certificate manager for radius
|
|
template: src=certs.j2 dest=/etc/acertmgr/{{ radius_hostname }}.conf
|
|
notify: Run acertmgr
|
|
|
|
- name: Create DH parameters
|
|
command: openssl dhparam -outform PEM -out {{ item }} 2048 creates={{ item }}
|
|
with_items:
|
|
- /etc/freeradius/3.0/certs/dh
|
|
notify: Restart freeradius
|
|
|
|
- name: Configure radius server
|
|
template: src={{ item }}.j2 dest=/etc/freeradius/3.0/{{ item }} owner=freerad group=freerad
|
|
with_items:
|
|
- clients.conf
|
|
notify: Restart freeradius
|
|
|
|
- name: Configure radius server
|
|
copy: src={{ item }} dest=/etc/freeradius/3.0/{{ item }} owner=freerad group=freerad
|
|
with_items:
|
|
- mods-available/eap
|
|
- mods-config/files/authorize
|
|
- sites-available/default
|
|
notify: Restart freeradius
|
|
|
|
- name: Ensure sites-enabled directory exists
|
|
file: path=/etc/freeradius/3.0/sites-enabled state=directory owner=freerad group=freerad
|
|
|
|
- name: Ensure sites are symlinked
|
|
file: src=../sites-available/{{ item }} dest=/etc/freeradius/3.0/sites-enabled/{{ item }} state=link
|
|
with_items:
|
|
- default
|
|
- inner-tunnel
|
|
notify: Restart freeradius
|
|
|
|
- name: Start the radius server
|
|
service: name=freeradius state=started enabled=yes
|