Add encryption role and related files

ansible/playbook_encryption.yml

@@ -1,151 +1,10 @@
 ---
-- name: Setup encrypted volume for a13labs
+- name: Setup encrypted volumes
   hosts: linux
-  become: true
-  vars:
-    disk_image_path: /a13labs.img
-    disk_image_size: 1G
-    luks_device_name: a13labs
-    mount_point: /a13labs
-    key_file_path: /root/a13labs.key
-    key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
-    key_fetch_service: a13labs-key.service
+  gather_facts: true
 
-  tasks:
-    - name: Install cryptsetup and curl
-      ansible.builtin.apt:
-        name:
-          - cryptsetup
-          - curl
-        state: present
-      when: ansible_os_family == 'Debian'
-
-    - name: Get mac address
-      ansible.builtin.shell: |
-        set -o pipefail
-        ip link show eth0 | awk '/ether/ {print $2}'
-      args:
-        executable: /bin/bash
-      register: mac_address
-      changed_when: false
-
-    - name: Sanitize mac address
-      ansible.builtin.set_fact:
-        mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}"
-      changed_when: false
-
-    - name: Create disk image
-      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
-      args:
-        creates: "{{ disk_image_path }}"
-      register: disk_image
-
-    - name: Create bucket URL
-      ansible.builtin.set_fact:
-        key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
-      changed_when: false
-
-    - name: Create encrypted volume # noqa no-handler
-      when: disk_image is changed
-      block:
-
-        - name: Download key file from Key server
-          ansible.builtin.uri:
-            url: "{{ key_file_url }}"
-            dest: "{{ key_file_path }}"
-            mode: '0600'
-          args:
-            creates: "{{ key_file_path }}"
-
-        - name: Set up LUKS encryption with key file
-          ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
-          changed_when: false
-
-        - name: Open LUKS device with key file
-          ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
-          register: luks_device
-          changed_when: false
-
-        - name: Create file system
-          ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
-          changed_when: false
-
-        - name: Close LUKS device
-          ansible.builtin.command: cryptsetup close {{ luks_device_name }}
-          changed_when: false
-
-        - name: Delete key file
-          ansible.builtin.file:
-            path: "{{ key_file_path }}"
-            state: absent
-
-    - name: Create mount point
-      ansible.builtin.file:
-        path: "{{ mount_point }}"
-        state: directory
-        mode: "0750"
-
-    - name: Create systemd service to fetch key file and open LUKS device
-      ansible.builtin.copy:
-        dest: /etc/systemd/system/{{ key_fetch_service }}
-        mode: '0644'
-        content: |
-          [Unit]
-          Description=Open LUKS device
-          After=network-online.target
-          Before=snap.microk8s.daemon-kubelite.service
-
-          [Service]
-          Type=oneshot
-          RemainAfterExit=true
-          ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
-          ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
-          ExecStartPost=/bin/rm -f {{ key_file_path }}
-          ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }}
-
-          [Install]
-          WantedBy=snap.microk8s.daemon-kubelite.service
-
-    - name: Create systemd service to mount the file system
-      ansible.builtin.copy:
-        dest: /etc/systemd/system/{{ mount_point | basename }}.mount
-        mode: '0644'
-        content: |
-          [Unit]
-          Description=Mount LUKS device
-          After={{ key_fetch_service }}
-          Requires={{ key_fetch_service }}
-          Before=snap.microk8s.daemon-kubelite.service
-
-          [Mount]
-          What=/dev/mapper/{{ luks_device_name }}
-          Where={{ mount_point }}
-          Type=ext4
-          Options=defaults
-
-          [Install]
-          WantedBy=snap.microk8s.daemon-kubelite.service
-
-    - name: Reload systemd daemon
-      ansible.builtin.systemd:
-        daemon_reload: true
-
-    - name: Enable the key fetch service
-      ansible.builtin.systemd:
-        name: "{{ key_fetch_service }}"
-        enabled: true
-
-    - name: Enable the mount device
-      ansible.builtin.systemd:
-        name: "{{ mount_point | basename }}.mount"
-        enabled: true
-
-    - name: Start the key fetch service
-      ansible.builtin.systemd:
-        name: "{{ key_fetch_service }}"
-        state: started
-
-    - name: Start the mount device
-      ansible.builtin.systemd:
-        name: "{{ mount_point | basename }}.mount"
-        state: started
+  roles:
+    - role: "encryption"
+      tags:
+        - roles
+        - roles::encryption