152 lines
4.7 KiB
YAML
152 lines
4.7 KiB
YAML
---
|
|
- name: Setup encrypted volume for a13labs
|
|
hosts: contabo
|
|
become: true
|
|
vars:
|
|
disk_image_path: /a13labs.img
|
|
disk_image_size: 1G
|
|
luks_device_name: a13labs
|
|
mount_point: /a13labs
|
|
key_file_path: /root/a13labs.key
|
|
key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
|
|
key_fetch_service: a13labs-key.service
|
|
|
|
tasks:
|
|
- name: Install cryptsetup and curl
|
|
ansible.builtin.apt:
|
|
name:
|
|
- cryptsetup
|
|
- curl
|
|
state: present
|
|
when: ansible_os_family == 'Debian'
|
|
|
|
- name: Get mac address
|
|
ansible.builtin.shell: |
|
|
set -o pipefail
|
|
ip link show eth0 | awk '/ether/ {print $2}'
|
|
args:
|
|
executable: /bin/bash
|
|
register: mac_address
|
|
changed_when: false
|
|
|
|
- name: Sanitize mac address
|
|
ansible.builtin.set_fact:
|
|
mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}"
|
|
changed_when: false
|
|
|
|
- name: Create disk image
|
|
ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
|
|
args:
|
|
creates: "{{ disk_image_path }}"
|
|
register: disk_image
|
|
|
|
- name: Create bucket URL
|
|
ansible.builtin.set_fact:
|
|
key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
|
|
changed_when: false
|
|
|
|
- name: Create encrypted volume # noqa no-handler
|
|
when: disk_image is changed
|
|
block:
|
|
|
|
- name: Download key file from Key server
|
|
ansible.builtin.uri:
|
|
url: "{{ key_file_url }}"
|
|
dest: "{{ key_file_path }}"
|
|
mode: '0600'
|
|
args:
|
|
creates: "{{ key_file_path }}"
|
|
|
|
- name: Set up LUKS encryption with key file
|
|
ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
|
|
changed_when: false
|
|
|
|
- name: Open LUKS device with key file
|
|
ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
|
|
register: luks_device
|
|
changed_when: false
|
|
|
|
- name: Create file system
|
|
ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
|
|
changed_when: false
|
|
|
|
- name: Close LUKS device
|
|
ansible.builtin.command: cryptsetup close {{ luks_device_name }}
|
|
changed_when: false
|
|
|
|
- name: Delete key file
|
|
ansible.builtin.file:
|
|
path: "{{ key_file_path }}"
|
|
state: absent
|
|
|
|
- name: Create mount point
|
|
ansible.builtin.file:
|
|
path: "{{ mount_point }}"
|
|
state: directory
|
|
mode: "0750"
|
|
|
|
- name: Create systemd service to fetch key file and open LUKS device
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/{{ key_fetch_service }}
|
|
mode: '0644'
|
|
content: |
|
|
[Unit]
|
|
Description=Open LUKS device
|
|
After=network-online.target
|
|
Before=snap.microk8s.daemon-kubelite.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=true
|
|
ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
|
|
ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
|
|
ExecStartPost=/bin/rm -f {{ key_file_path }}
|
|
ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }}
|
|
|
|
[Install]
|
|
WantedBy=snap.microk8s.daemon-kubelite.service
|
|
|
|
- name: Create systemd service to mount the file system
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/{{ mount_point | basename }}.mount
|
|
mode: '0644'
|
|
content: |
|
|
[Unit]
|
|
Description=Mount LUKS device
|
|
After={{ key_fetch_service }}
|
|
Requires={{ key_fetch_service }}
|
|
Before=snap.microk8s.daemon-kubelite.service
|
|
|
|
[Mount]
|
|
What=/dev/mapper/{{ luks_device_name }}
|
|
Where={{ mount_point }}
|
|
Type=ext4
|
|
Options=defaults
|
|
|
|
[Install]
|
|
WantedBy=snap.microk8s.daemon-kubelite.service
|
|
|
|
- name: Reload systemd daemon
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Enable the key fetch service
|
|
ansible.builtin.systemd:
|
|
name: "{{ key_fetch_service }}"
|
|
enabled: true
|
|
|
|
- name: Enable the mount device
|
|
ansible.builtin.systemd:
|
|
name: "{{ mount_point | basename }}.mount"
|
|
enabled: true
|
|
|
|
- name: Start the key fetch service
|
|
ansible.builtin.systemd:
|
|
name: "{{ key_fetch_service }}"
|
|
state: started
|
|
|
|
- name: Start the mount device
|
|
ansible.builtin.systemd:
|
|
name: "{{ mount_point | basename }}.mount"
|
|
state: started
|