Refactor requirements-dev.txt and remove molecule-vagrant

ansible/roles/encryption/files/open_volume

@@ -1,6 +1,6 @@
 #!/bin/bash
 if [ "$#" -ne 3 ]; then
-    echo "Usage: $0 <keyserver>"
+    echo "Usage: $0 <keyserver>" "<image>" "<device>"
     exit 1
 fi
 
@@ -9,19 +9,19 @@ IMAGE=$2
 DEVICE=$3
 
 if [ ! -e $IMAGE ]; then
-    logger "open_volume: Image file not found"
+    logger "open_volume: ($DEVICE) Image file not found"
     exit 1
 fi
 
 # if keyserver is not reachable, exit
 if ! curl -s -I $KEYSERVER > /dev/null; then
-    logger "open_volume: Key server not reachable, exiting."
+    logger "open_volume: ($DEVICE) Key server not reachable, exiting."
     exit 1
 fi
 
 # If device is already open, exit
 if [ -e /dev/mapper/$DEVICE ]; then
-    echo "open_volume: Device already open, exiting."
+    echo "open_volume: ($DEVICE) Device already open, exiting."
     exit 1
 fi
 
@@ -30,21 +30,21 @@ uuid+=$(ip link show eth0 | grep ether | awk '{print $2}')
 uuid+=$(sudo dmidecode -s system-uuid)
 KEYID=$(echo -n "$uuid" | md5sum | awk '{print $1}')
 
-logger "open_volume: Downloading key from key server,"
+logger "open_volume: ($DEVICE) Downloading key from key server,"
 LOCALKEYFILE=$(mktemp)
 curl -s -o $LOCALKEYFILE $KEYSERVER/$KEYID
 if [ $? -ne 0 ]; then
-    logger "open_volume: Failed to download key from key server"
+    logger "open_volume: ($DEVICE) Failed to download key from key server"
     rm $LOCALKEYFILE
     exit 1
 fi
-logger "open_volume: Key downloaded successfully, opening volume"
+logger "open_volume:'$DEVICE' Key downloaded successfully, opening volume"
 /usr/sbin/cryptsetup luksOpen $IMAGE $DEVICE -d $LOCALKEYFILE
 if [ $? -ne 0 ]; then
-    logger "open_volume: Failed to open volume"
+    logger "open_volume: ($DEVICE) Failed to open volume"
     rm $LOCALKEYFILE
     exit 1
 fi
-logger "open_volume: Volume opened successfully, removing key file"
+logger "open_volume: ($DEVICE) Volume opened successfully, removing key file"
 rm $LOCALKEYFILE
 exit 0

ansible/roles/encryption/tasks/volume.yml

@@ -1,10 +1,10 @@
 - name: Check for required variables
   ansible.builtin.fail:
-    msg: "The following variables are required: size, name, key_file_url, mount_point"
+    msg: "The following variables are required: size, name, key_server, mount_point"
   when:
     - item.size is not defined
     - item.name is not defined
-    - item.key_file_url is not defined
+    - item.key_server is not defined
     - item.mount_point is not defined
 
 - name: Set required facts
@@ -12,7 +12,7 @@
     encryption_volumes_path: "{{ encryption_volumes_path | default('/var/lib/encrypted_volumes') }}"
     size: "{{ item.size | default(encryption_volumes_default_size) }}"
     fstype: "{{ item.fstype | default('ext4') }}"
-    key_file_url: "{{ item.key_file_url }}"
+    key_server: "{{ item.key_server }}"
     key_file_path: "{{ ansible_env.TMPDIR }}/{{ item.name }}.key"
     disk_image_path: "{{ encryption_volumes_path }}/{{ item.name }}.img"
     device_name: "{{ item.name }}_luks"
@@ -41,9 +41,14 @@
   when: disk_image is changed
   become: true
   block:
+    - name: Read system id
+      ansible.builtin.command: |
+        read_system_id
+      register: system_id
+
     - name: Download key file from Key server
       ansible.builtin.uri:
-        url: "{{ key_file_url }}"
+        url: "{{ key_server }}/{{ system_id.stdout }}"
         dest: "{{ key_file_path }}"
         mode: "0600"
       args:
@@ -95,9 +100,7 @@
       [Service]
       Type=oneshot
       RemainAfterExit=true
-      ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
-      ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ device_name }} -d {{ key_file_path }}
-      ExecStartPost=/bin/rm -f {{ key_file_path }}
+      ExecStart=/usr/local/bin/open_volume "{{ key_server }}" {{ disk_image_path }} {{ device_name }}
       ExecStop=/usr/sbin/cryptsetup close {{ device_name }}
 
       [Install]