119 lines
3.8 KiB
YAML
119 lines
3.8 KiB
YAML
---
|
|
- name: Create LUKS encrypted file system with key file fetched from HTTP server
|
|
hosts: contabo
|
|
become: yes
|
|
vars:
|
|
disk_image_path: /a13labs.img
|
|
disk_image_size: 1G
|
|
luks_device_name: luks_device
|
|
mount_point: /a13labs
|
|
key_file_path: /root/luks_keyfile
|
|
key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
|
|
key_fetch_service: fetch-a13labs-key.service
|
|
|
|
tasks:
|
|
- name: Install cryptsetup and curl
|
|
apt:
|
|
name:
|
|
- cryptsetup
|
|
- curl
|
|
state: present
|
|
when: ansible_os_family == 'Debian'
|
|
|
|
- name: Create disk image
|
|
ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
|
|
args:
|
|
creates: "{{ disk_image_path }}"
|
|
register: disk_image
|
|
|
|
- name: Create encrypted volume
|
|
when: disk_image is changed
|
|
block:
|
|
- name: Get mac address
|
|
ansible.builtin.shell: |
|
|
set -o pipefail
|
|
ip link show eth0 | awk '/ether/ {print $2}'
|
|
args:
|
|
executable: /bin/bash
|
|
register: mac_address
|
|
changed_when: false
|
|
|
|
- name: Sanitize mac address
|
|
set_fact:
|
|
mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}"
|
|
changed_when: false
|
|
|
|
- name: Create bucket URL
|
|
set_fact:
|
|
key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
|
|
changed_when: false
|
|
|
|
- name: Download key file from HTTP server
|
|
ansible.builtin.uri:
|
|
url: "{{ key_file_url }}"
|
|
dest: "{{ key_file_path }}"
|
|
mode: '0600'
|
|
args:
|
|
creates: "{{ key_file_path }}"
|
|
|
|
- name: Set up LUKS encryption with key file
|
|
ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
|
|
|
|
- name: Open LUKS device with key file
|
|
ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
|
|
register: luks_device
|
|
|
|
- name: Delete key file
|
|
ansible.builtin.file:
|
|
path: "{{ key_file_path }}"
|
|
state: absent
|
|
|
|
- name: Create file system
|
|
ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
|
|
|
|
- name: Create mount point
|
|
file:
|
|
path: "{{ mount_point }}"
|
|
state: directory
|
|
|
|
- name: Mount the file system
|
|
ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }}
|
|
|
|
- name: Ensure the file system is mounted
|
|
mount:
|
|
path: "{{ mount_point }}"
|
|
src: /dev/mapper/{{ luks_device_name }}
|
|
fstype: ext4
|
|
state: mounted
|
|
|
|
- name: Create systemd service to fetch key file and open LUKS device
|
|
copy:
|
|
dest: /etc/systemd/system/{{ key_fetch_service }}
|
|
content: |
|
|
[Unit]
|
|
Description=Fetch LUKS key file from HTTP server and open LUKS device
|
|
After=network-online.target
|
|
Before=cryptsetup.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }}
|
|
ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
|
|
ExecStartPost=/bin/rm -f {{ key_file_path }}
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
- name: Reload systemd daemon
|
|
ansible.builtin.command: systemctl daemon-reload
|
|
|
|
- name: Enable the key fetch service
|
|
ansible.builtin.command: systemctl enable {{ key_fetch_service }}
|
|
|
|
- name: Add entry to /etc/fstab
|
|
lineinfile:
|
|
path: /etc/fstab
|
|
line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2"
|
|
create: yes
|
|
|