infra/roles/radius/tasks/main.yml

---

- name: Install radius server
  apt: name=freeradius

- name: Ensure certificates are available
  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/freeradius/3.0/certs/srv.key -out /etc/freeradius/3.0/certs/srv.crt -days 730 -subj "/CN={{ ansible_fqdn }}" creates=/etc/freeradius/3.0/certs/srv.crt
  notify: Restart freeradius

- name: Ensure correct certificate permissions
  file: path=/etc/freeradius/3.0/certs/srv.key owner=freerad mode=0400
  notify: Restart freeradius

- name: Request nsupdate key for certificate
  include_role: name=acme-dnskey-generate
  vars:
    acme_dnskey_san_domains:
    - "{{ radius_hostname }}"
    - "{{ radius_cn }}"

- name: Configure certificate manager for radius
  template: src=certs.j2 dest=/etc/acertmgr/{{ radius_hostname }}.conf
  notify: Run acertmgr

- name: Create DH parameters
  command: openssl dhparam -outform PEM -out {{ item }} 2048 creates={{ item }}
  with_items:
  - /etc/freeradius/3.0/certs/dh
  notify: Restart freeradius

- name: Configure radius server
  template: src={{ item }}.j2 dest=/etc/freeradius/3.0/{{ item }} owner=freerad group=freerad
  with_items:
  - clients.conf
  notify: Restart freeradius

- name: Configure radius server
  copy: src={{ item }} dest=/etc/freeradius/3.0/{{ item }} owner=freerad group=freerad
  with_items:
  - mods-available/eap
  - mods-config/files/authorize
  - sites-available/default
  notify: Restart freeradius

- name: Ensure sites-enabled directory exists
  file: path=/etc/freeradius/3.0/sites-enabled state=directory owner=freerad group=freerad

- name: Ensure sites are symlinked
  file: src=../sites-available/{{ item }} dest=/etc/freeradius/3.0/sites-enabled/{{ item }} state=link
  with_items:
  - default
  - inner-tunnel
  notify: Restart freeradius

- name: Start the radius server
  service: name=freeradius state=started enabled=yes