From ff523bd14b2684c2b02787f47f9088c1c50d18e3 Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Tue, 1 Oct 2024 22:57:13 +0200
Subject: [PATCH] Refactor inventory file and add encryption scripts

---
 ansible/inventory/hosts                       |  3 ++
 ansible/roles/encryption/files/open_volume    | 50 +++++++++++++++++++
 ansible/roles/encryption/files/read_system_id |  5 ++
 ansible/roles/encryption/tasks/main.yml       | 10 ++++
 4 files changed, 68 insertions(+)
 create mode 100644 ansible/roles/encryption/files/open_volume
 create mode 100644 ansible/roles/encryption/files/read_system_id

diff --git a/ansible/inventory/hosts b/ansible/inventory/hosts
index 3624061..31f5fe5 100644
--- a/ansible/inventory/hosts
+++ b/ansible/inventory/hosts
@@ -21,3 +21,6 @@ contabo01.a13labs.pt
 
 [microk8s]
 contabo01.a13labs.pt
+
+[iac]
+contabo01.a13labs.pt
diff --git a/ansible/roles/encryption/files/open_volume b/ansible/roles/encryption/files/open_volume
new file mode 100644
index 0000000..bc35d8e
--- /dev/null
+++ b/ansible/roles/encryption/files/open_volume
@@ -0,0 +1,50 @@
+#!/bin/bash
+if [ "$#" -ne 3 ]; then
+    echo "Usage: $0 <keyserver>"
+    exit 1
+fi
+
+KEYSERVER=$1
+IMAGE=$2
+DEVICE=$3
+
+if [ ! -e $IMAGE ]; then
+    logger "open_volume: Image file not found"
+    exit 1
+fi
+
+# if keyserver is not reachable, exit
+if ! curl -s -I $KEYSERVER > /dev/null; then
+    logger "open_volume: Key server not reachable, exiting."
+    exit 1
+fi
+
+# If device is already open, exit
+if [ -e /dev/mapper/$DEVICE ]; then
+    echo "open_volume: Device already open, exiting."
+    exit 1
+fi
+
+uuid=$(cat /proc/cpuinfo | grep 'model name' | head -1)
+uuid+=$(ip link show eth0 | grep ether | awk '{print $2}')
+uuid+=$(sudo dmidecode -s system-uuid)
+KEYID=$(echo -n "$uuid" | md5sum | awk '{print $1}')
+
+logger "open_volume: Downloading key from key server,"
+LOCALKEYFILE=$(mktemp)
+curl -s -o $LOCALKEYFILE $KEYSERVER/$KEYID
+if [ $? -ne 0 ]; then
+    logger "open_volume: Failed to download key from key server"
+    rm $LOCALKEYFILE
+    exit 1
+fi
+logger "open_volume: Key downloaded successfully, opening volume"
+/usr/sbin/cryptsetup luksOpen $IMAGE $DEVICE -d $LOCALKEYFILE
+if [ $? -ne 0 ]; then
+    logger "open_volume: Failed to open volume"
+    rm $LOCALKEYFILE
+    exit 1
+fi
+logger "open_volume: Volume opened successfully, removing key file"
+rm $LOCALKEYFILE
+exit 0
\ No newline at end of file
diff --git a/ansible/roles/encryption/files/read_system_id b/ansible/roles/encryption/files/read_system_id
new file mode 100644
index 0000000..1127671
--- /dev/null
+++ b/ansible/roles/encryption/files/read_system_id
@@ -0,0 +1,5 @@
+#!/bin/bash
+uuid=$(cat /proc/cpuinfo | grep 'model name' | head -1)
+uuid+=$(ip link show eth0 | grep ether | awk '{print $2}')
+uuid+=$(sudo dmidecode -s system-uuid)
+echo -n "$uuid" | md5sum | awk '{print $1}'
\ No newline at end of file
diff --git a/ansible/roles/encryption/tasks/main.yml b/ansible/roles/encryption/tasks/main.yml
index 4bcbe07..792e4ee 100644
--- a/ansible/roles/encryption/tasks/main.yml
+++ b/ansible/roles/encryption/tasks/main.yml
@@ -15,6 +15,16 @@
     state: directory
     mode: "0750"
 
+- name: Copy required scripts
+  become: true
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/usr/local/bin/"
+    mode: "0750"
+  with_items:
+    - "open_volume"
+    - "read_system_id"
+
 - name: Create encrypted volumes
   ansible.builtin.include_tasks: volume.yml
   loop: "{{ encryption_volumes }}"