Add encryption role and related files

ansible/roles/encryption/tasks/main.yml

@@ -0,0 +1,22 @@
+---
+- name: Install cryptsetup and curl
+  become: true
+  ansible.builtin.apt:
+    name:
+      - cryptsetup
+      - curl
+    state: present
+  when: ansible_os_family == 'Debian'
+
+- name: Create folder to store volume
+  become: true
+  ansible.builtin.file:
+    path: "{{ encryption_volumes_path }}"
+    state: directory
+    mode: "0750"
+
+- name: Create encrypted volumes
+  ansible.builtin.include_tasks: volume.yml
+  loop: "{{ encryption_volumes }}"
+  loop_control:
+    loop_var: item

ansible/roles/encryption/tasks/volume.yml

@@ -0,0 +1,149 @@
+- name: Check for required variables
+  ansible.builtin.fail:
+    msg: "The following variables are required: size, name, key_file_url, mount_point"
+  when:
+    - item.size is not defined
+    - item.name is not defined
+    - item.key_file_url is not defined
+    - item.mount_point is not defined
+
+- name: Set required facts
+  ansible.builtin.set_fact:
+    encryption_volumes_path: "{{ encryption_volumes_path | default('/var/lib/encrypted_volumes') }}"
+    size: "{{ item.size | default(encryption_volumes_default_size) }}"
+    fstype: "{{ item.fstype | default('ext4') }}"
+    key_file_url: "{{ item.key_file_url }}"
+    key_file_path: "{{ ansible_env.TMPDIR }}/{{ item.name }}.key"
+    disk_image_path: "{{ encryption_volumes_path }}/{{ item.name }}.img"
+    device_name: "{{ item.name }}_luks"
+    key_fetch_service: "{{ item.name }}_key.service"
+    mount_point: "{{ item.mount_point | default('/mnt/' + item.name) }}"
+    fetch_key_service_before: "{{ item.fetch_key_service_before | default('') }}"
+    fetch_key_service_after: "{{ item.fetch_key_service_after | default('') }}"
+    fetch_key_service_wantedby: "{{ item.fetch_key_service_wantedby | default('mulit-user.target') }}"
+    mount_service_before: "{{ item.mount_service_before | default('') }}"
+    mount_service_wantedby: "{{ item.mount_service_wantedby | default('multi-user.target') }}"
+    mount_permission: "{{ item.mount_permission | default('0750') }}"
+
+- name: Set transformed facts
+  ansible.builtin.set_fact:
+    mount_service: "{{ mount_point | regex_replace('^/', '') | replace('/', '-') }}.mount"
+
+- name: Create disk image '{{ item.name }}'
+  become: true
+  ansible.builtin.command: |
+    fallocate -l {{ size }} {{ disk_image_path }}
+  args:
+    creates: "{{ disk_image_path }}"
+  register: disk_image
+
+- name: Create encrypted volume # noqa no-handler
+  when: disk_image is changed
+  become: true
+  block:
+    - name: Download key file from Key server
+      ansible.builtin.uri:
+        url: "{{ key_file_url }}"
+        dest: "{{ key_file_path }}"
+        mode: "0600"
+      args:
+        creates: "{{ key_file_path }}"
+
+    - name: Format LUKS device
+      ansible.builtin.command: |
+        cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
+      changed_when: false
+
+    - name: Open LUKS device with key file
+      ansible.builtin.command: |
+        cryptsetup luksOpen {{ disk_image_path }} {{ device_name }} -d {{ key_file_path }}
+      register: luks_device
+      changed_when: false
+
+    - name: Create file system
+      ansible.builtin.command: |
+        mkfs.{{ fstype }} /dev/mapper/{{ device_name }}
+      changed_when: false
+
+    - name: Close LUKS device
+      ansible.builtin.command: cryptsetup close {{ device_name }}
+      changed_when: false
+
+    - name: Delete key file
+      ansible.builtin.file:
+        path: "{{ key_file_path }}"
+        state: absent
+
+- name: Create mount point
+  become: true
+  ansible.builtin.file:
+    path: "{{ mount_point }}"
+    state: directory
+    mode: "{{ mount_permission }}"
+
+- name: Create service to fetch key file and open LUKS device
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/{{ key_fetch_service }}
+    mode: "0644"
+    content: |
+      [Unit]
+      Description={{ item.name }} key fetch service
+      After={{ fetch_key_service_after }}
+      Before={{ fetch_key_service_before }}
+
+      [Service]
+      Type=oneshot
+      RemainAfterExit=true
+      ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
+      ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ device_name }} -d {{ key_file_path }}
+      ExecStartPost=/bin/rm -f {{ key_file_path }}
+      ExecStop=/usr/sbin/cryptsetup close {{ device_name }}
+
+      [Install]
+      WantedBy={{ fetch_key_service_wantedby }}
+
+- name: Create service to mount the local filesystem
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/{{ mount_service }}
+    mode: "0644"
+    content: |
+      [Unit]
+
+      Description={{ item.name }} mount service
+      After={{ key_fetch_service }}
+      Requires={{ key_fetch_service }}
+      Before={{ mount_service_before }}
+
+      [Mount]
+      What=/dev/mapper/{{ device_name }}
+      Where={{ mount_point }}
+      Type=ext4
+      Options=defaults
+
+      [Install]
+      WantedBy={{ mount_service_wantedby }}
+
+- name: Reload systemd daemon
+  become: true
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Enable the services
+  become: true
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+  loop:
+    - "{{ key_fetch_service }}"
+    - "{{ mount_service }}"
+
+- name: Start the services
+  become: true
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    state: started
+  loop:
+    - "{{ key_fetch_service }}"
+    - "{{ mount_service }}"