feat(fwknopd): add Ansible role for fwknopd management with necessary tasks and configurations

ansible/roles/fwknopd/defaults/main.yml

@@ -0,0 +1,3 @@
+fwknopd_keys_dir: /etc/fwknop
+fwknopd_key_base64: "<REPLACE_WITH_YOUR_KEY>"
+fwknopd_hmac_key_base64: "<REPLACE_WITH_YOUR_HMAC>"

ansible/roles/fwknopd/meta/main.yml

@@ -0,0 +1,39 @@
+---
+galaxy_info:
+  author: Alexandre Pires
+  description: Manage fwknopd on Linux
+  company: A13Labs
+  role_name: fwknopd
+  namespace: a13labs
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: MIT
+
+  min_ansible_version: "2.1"
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags:
+    []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies:
+  []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

ansible/roles/fwknopd/molecule/default/converge.yml

@@ -0,0 +1,8 @@
+---
+- name: Converge
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Include role fwknopd
+      ansible.builtin.include_role:
+        name: fwknopd

ansible/roles/fwknopd/molecule/default/molecule.yml

@@ -0,0 +1,23 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: podman
+platforms:
+  - name: instance
+    image: nmusatti/ubuntu2204-pys-systemd:latest
+    pre_build_image: true
+    privileged: true
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+provisioner:
+  name: ansible
+  options:
+    vvv: true
+  env:
+    ANSIBLE_ROLES_PATH: ../../../
+verifier:
+  name: ansible

ansible/roles/fwknopd/molecule/default/prepare.yml

@@ -0,0 +1,30 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Update cache # noqa no-changed-when
+      ansible.builtin.raw: apt update
+
+    - name: Install required packages # noqa no-changed-when
+      ansible.builtin.raw: apt install -y python3 sudo
+
+    - name: Install required packages # noqa no-changed-when
+      ansible.builtin.shell: |
+        set -o pipefail
+        apt install -y systemd
+        find /etc/systemd/system/*.wants /lib/systemd/system/multi-user.target.wants /lib/systemd/system/local-fs.target.wants /lib/systemd/system/sockets.target.wants -type f -name '*initctl*' -delete
+        find /lib/systemd/system/sysinit.target.wants -type f ! -name '*systemd-tmpfiles-setup*' -delete
+        find /lib/systemd -type f -name systemd-update-utmp-runlevel.service -delete
+        rm -vf /usr/share/systemd/tmp.mount
+        sed -ri '/^IPAddressDeny/d' /lib/systemd/system/systemd-journald.service
+        for MATCH in plymouth-start.service plymouth-quit-wait.service syslog.socket syslog.service display-manager.service systemd-sysusers.service tmp.mount systemd-udevd.service; do \
+            grep -rn --binary-files=without-match  ${MATCH} /lib/systemd/ | cut -d: -f1 | xargs -r sed -ri 's/(.*=.*)'${MATCH}'(.*)/\1\2/'; \
+        done
+        systemctl disable ondemand.service
+        systemctl set-default multi-user.target
+      become: true
+      args:
+        executable: /bin/bash
+      environment:
+        DEBIAN_FRONTEND: noninteractive

ansible/roles/fwknopd/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+- name: Install fwknop
+  ansible.builtin.package:
+    name: fwknop-server
+    state: present
+    update_cache: true
+
+- name: Enable and start fwknopd
+  ansible.builtin.systemd:
+    name: fwknopd
+    enabled: true
+    state: started
+
+- name: Generate fwknop key pair
+  ansible.builtin.command: fwknop --key-gen
+  args:
+    creates: "{{ fwknopd_keys_dir }}/access.conf"
+
+- name: Copy access.conf
+  ansible.builtin.template:
+    src: access.conf.j2
+    dest: "{{ fwknopd_keys_dir }}/access.conf"
+    owner: root
+    group: root
+    mode: '0600'

ansible/roles/fwknopd/templates/access.conf.j2

@@ -0,0 +1,6 @@
+SOURCE ANY
+KEY_BASE64 {{ fwknopd_key_base64 }}
+HMAC_KEY_BASE64 {{ fwknopd_hmac_key_base64 }}
+ALLOW_IP ANY
+OPEN_PORTS tcp/22
+FW_ACCESS_TIMEOUT 30