1+ # SPDX-License-Identifier: MIT
2+ ---
3+ - name : Ensure required packages are installed
4+ ansible.builtin.package :
5+ name : " {{ __trustee_server_trustee_packages }}"
6+ state : present
7+ use : " {{ (__trustee_server_is_ostree | d(false)) |
8+ ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
9+
10+ - name : Ensure quadlet install directory exists
11+ ansible.builtin.file :
12+ path : " {{ trustee_server_quadlet_install_dir }}"
13+ state : directory
14+ mode : " 0755"
15+
16+ - name : Create a temporary directory for the quadlet repository
17+ ansible.builtin.tempfile :
18+ state : directory
19+ register : __trustee_server_quadlet_repo_dir
20+
21+ - name : Download Trustee Server quadlet files from GitHub repository
22+ ansible.builtin.git :
23+ repo : " {{ trustee_server_quadlet_repo_url }}"
24+ dest : " {{ __trustee_server_quadlet_repo_dir.path }}"
25+ version : " {{ trustee_server_quadlet_repo_branch }}"
26+ depth : 1
27+ force : true
28+ register : quadlet_repo_download
29+
30+ - name : Find Trustee Server quadlet files in repository
31+ ansible.builtin.find :
32+ paths : " {{ __trustee_server_quadlet_repo_dir.path }}/{{ trustee_server_quadlet_repo_path }}"
33+ patterns :
34+ - " *.container"
35+ - " *.volume"
36+ - " *.network"
37+ - " *.pod"
38+ recurse : false
39+ register : quadlet_files_found
40+
41+ - name : Fail if no Trustee Server quadlet files found
42+ ansible.builtin.fail :
43+ msg : " No quadlet files found in {{ trustee_server_quadlet_repo_url }}/{{ trustee_server_quadlet_repo_path }}"
44+ when : quadlet_files_found.files | length == 0
45+
46+ - name : Copy Trustee Server quadlet files to install directory
47+ ansible.builtin.copy :
48+ src : " {{ item.path }}"
49+ dest : " {{ trustee_server_quadlet_install_dir }}/{{ item.path | basename }}"
50+ mode : " 0644"
51+ remote_src : true
52+ force : true
53+ loop : " {{ quadlet_files_found.files }}"
54+ register : quadlet_files_copied
55+
56+ - name : Stat repository configs directory
57+ ansible.builtin.stat :
58+ path : " {{ __trustee_server_quadlet_repo_dir.path }}/configs"
59+ register : __repo_configs_dir
60+
61+ - name : Copy Trustee Server config files to config directory
62+ ansible.builtin.copy :
63+ src : " {{ __trustee_server_quadlet_repo_dir.path }}/configs/"
64+ dest : " {{ trustee_attestation_server_config_dir }}/"
65+ mode : " 0644"
66+ remote_src : true
67+ force : true
68+ when : __repo_configs_dir.stat.exists
69+
70+ - name : Generate certificates for all components
71+ ansible.builtin.shell : |
72+ # Trustee Server SSL
73+ if [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/server.crt ] || [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/server.key ]; then
74+ openssl req -new -x509 -nodes -sha256 -days 3550 \
75+ -subj "/CN=$(hostname -f)/O=Red Hat" \
76+ -out {{ trustee_attestation_server_config_dir }}/kbs/server.crt -keyout {{ trustee_attestation_server_config_dir }}/kbs/server.key
77+ fi
78+ # KBS authentication key pair
79+ if [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/auth.key ] || [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/auth.pub ]; then
80+ openssl genpkey -algorithm ed25519 -out {{ trustee_attestation_server_config_dir }}/kbs/auth.key
81+ openssl pkey -in {{ trustee_attestation_server_config_dir }}/kbs/auth.key -pubout -out {{ trustee_attestation_server_config_dir }}/kbs/auth.pub
82+ fi
83+ # Attestation Service token signer key pair
84+ if [ ! -f {{ trustee_attestation_server_config_dir }}/as/token.key ] || [ ! -f {{ trustee_attestation_server_config_dir }}/as/token.crt ]; then
85+ openssl ecparam -name prime256v1 -genkey -noout -out {{ trustee_attestation_server_config_dir }}/as/token.key
86+ openssl req -new -x509 -key {{ trustee_attestation_server_config_dir }}/as/token.key \
87+ -out {{ trustee_attestation_server_config_dir }}/as/token.crt -days 3550 \
88+ -subj "/CN=as-token-signer/O=Red Hat"
89+ mkdir -p {{ trustee_attestation_server_config_dir }}/kbs/trusted_certs
90+ cp {{ trustee_attestation_server_config_dir }}/as/token.crt {{ trustee_attestation_server_config_dir }}/kbs/trusted_certs/token0.crt
91+ fi
92+
93+ name : Gather service facts
94+ ansible.builtin.service_facts :
95+
96+ - name : Allow port 8080 in firewall
97+ ansible.posix.firewalld :
98+ port : " 8080/tcp"
99+ permanent : true
100+ immediate : true
101+ state : enabled
102+ when : ansible_facts.services['firewalld.service'].state == 'running'
103+
104+ - name : Get the installed Trustee Server pod name
105+ ansible.builtin.find :
106+ paths : " {{ trustee_server_quadlet_install_dir }}"
107+ patterns : " *.pod"
108+ register : trustee_server_pod_name
109+
110+ - name : Enable and start Trustee Server services
111+ ansible.builtin.systemd :
112+ name : " {{ trustee_server_pod_name.files[0].path | basename | regex_replace('\\ .pod$', '') }}-pod.service"
113+ enabled : true
114+ state : restarted
115+ daemon_reload : true
116+ when : trustee_server_pod_name.files | length > 0
117+ failed_when : false
118+
119+ # TODO keep the server.crt and DNS names in the role variables
120+
121+ - name : Clean up temporary repository directory
122+ ansible.builtin.file :
123+ path : " {{ __trustee_server_quadlet_repo_dir.path }}"
124+ state : absent
0 commit comments