Refactor inventory file and add encryption scripts

ansible/inventory/hosts

@@ -21,3 +21,6 @@ contabo01.a13labs.pt
 
 [microk8s]
 contabo01.a13labs.pt
+
+[iac]
+contabo01.a13labs.pt

ansible/roles/encryption/files/open_volume

@@ -0,0 +1,50 @@
+#!/bin/bash
+if [ "$#" -ne 3 ]; then
+    echo "Usage: $0 <keyserver>"
+    exit 1
+fi
+
+KEYSERVER=$1
+IMAGE=$2
+DEVICE=$3
+
+if [ ! -e $IMAGE ]; then
+    logger "open_volume: Image file not found"
+    exit 1
+fi
+
+# if keyserver is not reachable, exit
+if ! curl -s -I $KEYSERVER > /dev/null; then
+    logger "open_volume: Key server not reachable, exiting."
+    exit 1
+fi
+
+# If device is already open, exit
+if [ -e /dev/mapper/$DEVICE ]; then
+    echo "open_volume: Device already open, exiting."
+    exit 1
+fi
+
+uuid=$(cat /proc/cpuinfo | grep 'model name' | head -1)
+uuid+=$(ip link show eth0 | grep ether | awk '{print $2}')
+uuid+=$(sudo dmidecode -s system-uuid)
+KEYID=$(echo -n "$uuid" | md5sum | awk '{print $1}')
+
+logger "open_volume: Downloading key from key server,"
+LOCALKEYFILE=$(mktemp)
+curl -s -o $LOCALKEYFILE $KEYSERVER/$KEYID
+if [ $? -ne 0 ]; then
+    logger "open_volume: Failed to download key from key server"
+    rm $LOCALKEYFILE
+    exit 1
+fi
+logger "open_volume: Key downloaded successfully, opening volume"
+/usr/sbin/cryptsetup luksOpen $IMAGE $DEVICE -d $LOCALKEYFILE
+if [ $? -ne 0 ]; then
+    logger "open_volume: Failed to open volume"
+    rm $LOCALKEYFILE
+    exit 1
+fi
+logger "open_volume: Volume opened successfully, removing key file"
+rm $LOCALKEYFILE
+exit 0

ansible/roles/encryption/files/read_system_id

@@ -0,0 +1,5 @@
+#!/bin/bash
+uuid=$(cat /proc/cpuinfo | grep 'model name' | head -1)
+uuid+=$(ip link show eth0 | grep ether | awk '{print $2}')
+uuid+=$(sudo dmidecode -s system-uuid)
+echo -n "$uuid" | md5sum | awk '{print $1}'

ansible/roles/encryption/tasks/main.yml

@@ -15,6 +15,16 @@
     state: directory
     mode: "0750"
 
+- name: Copy required scripts
+  become: true
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/usr/local/bin/"
+    mode: "0750"
+  with_items:
+    - "open_volume"
+    - "read_system_id"
+
 - name: Create encrypted volumes
   ansible.builtin.include_tasks: volume.yml
   loop: "{{ encryption_volumes }}"