Add infrastructure bucket for storing assets

2024-09-28 19:15:56 +02:00
parent 52d6d85203
commit 4de62d7334
17 changed files with 414 additions and 28 deletions
@@ -0,0 +1,118 @@
+---
+- name: Create LUKS encrypted file system with key file fetched from HTTP server
+  hosts: contabo
+  become: yes
+  vars:
+    disk_image_path: /a13labs.img
+    disk_image_size: 1G
+    luks_device_name: luks_device
+    mount_point: /a13labs
+    key_file_path: /root/luks_keyfile
+    key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
+    key_fetch_service: fetch-a13labs-key.service
+
+  tasks:
+    - name: Install cryptsetup and curl
+      apt:
+        name:
+          - cryptsetup
+          - curl
+        state: present
+      when: ansible_os_family == 'Debian'
+
+    - name: Create disk image
+      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
+      args:
+        creates: "{{ disk_image_path }}"
+      register: disk_image
+
+    - name: Create encrypted volume
+      when: disk_image is changed
+      block: 
+      - name: Get mac address
+        ansible.builtin.shell: |
+          set -o pipefail        
+          ip link show eth0 | awk '/ether/ {print $2}'
+        args:
+          executable: /bin/bash
+        register: mac_address
+        changed_when: false
+
+      - name: Sanitize mac address
+        set_fact:
+          mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}"
+        changed_when: false
+
+      - name: Create bucket URL
+        set_fact:
+          key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
+        changed_when: false
+
+      - name: Download key file from HTTP server
+        ansible.builtin.uri:
+          url: "{{ key_file_url }}"
+          dest: "{{ key_file_path }}"
+          mode: '0600'
+        args:
+          creates: "{{ key_file_path }}"
+
+      - name: Set up LUKS encryption with key file
+        ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
+
+      - name: Open LUKS device with key file
+        ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+        register: luks_device
+
+      - name: Delete key file
+        ansible.builtin.file:
+          path: "{{ key_file_path }}"
+          state: absent
+
+      - name: Create file system
+        ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
+
+      - name: Create mount point
+        file:
+          path: "{{ mount_point }}"
+          state: directory
+
+      - name: Mount the file system
+        ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }}
+
+      - name: Ensure the file system is mounted
+        mount:
+          path: "{{ mount_point }}"
+          src: /dev/mapper/{{ luks_device_name }}
+          fstype: ext4
+          state: mounted
+
+      - name: Create systemd service to fetch key file and open LUKS device
+        copy:
+          dest: /etc/systemd/system/{{ key_fetch_service }}
+          content: |
+            [Unit]
+            Description=Fetch LUKS key file from HTTP server and open LUKS device
+            After=network-online.target
+            Before=cryptsetup.target
+
+            [Service]
+            Type=oneshot
+            ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }}
+            ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+            ExecStartPost=/bin/rm -f {{ key_file_path }}
+
+            [Install]
+            WantedBy=multi-user.target
+
+      - name: Reload systemd daemon
+        ansible.builtin.command: systemctl daemon-reload
+
+      - name: Enable the key fetch service
+        ansible.builtin.command: systemctl enable {{ key_fetch_service }}
+
+      - name: Add entry to /etc/fstab
+        lineinfile:
+          path: /etc/fstab
+          line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2"
+          create: yes
+