98 lines
2.9 KiB
YAML
98 lines
2.9 KiB
YAML
- name: step-ca
|
|
ansible.builtin.import_playbook: step-ca.yml
|
|
|
|
- name: Fetch Step-CA root certificate
|
|
hosts: localhost
|
|
gather_facts: false
|
|
vars:
|
|
step_ca_primary: pi1
|
|
step_ca_user: step
|
|
step_ca_root: "/home/step/.step/certs/root_ca.crt"
|
|
tmp_dir: "/tmp/step-ca-cert-manager"
|
|
tasks:
|
|
- name: Ensure local temp directory exists
|
|
file:
|
|
path: "{{ tmp_dir }}"
|
|
state: directory
|
|
mode: "0700"
|
|
|
|
- name: Fetch root CA from step_ca_primary
|
|
fetch:
|
|
src: "{{ step_ca_root }}"
|
|
dest: "{{ tmp_dir }}/root_ca.crt"
|
|
flat: true
|
|
delegate_to: "{{ step_ca_primary }}"
|
|
become: true
|
|
become_user: "{{ step_ca_user }}"
|
|
run_once: true
|
|
|
|
- name: Préparer le répertoire de build
|
|
file:
|
|
path: /tmp/gitea-runner-image
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Copier le root CA dans le contexte Docker
|
|
copy:
|
|
src: "{{ tmp_dir }}/root_ca.crt"
|
|
dest: /tmp/gitea-runner-image/root_ca.crt
|
|
mode: '0644'
|
|
|
|
- name: Créer le Dockerfile pour l'image runner avec CA custom
|
|
copy:
|
|
dest: /tmp/gitea-runner-image/Dockerfile
|
|
mode: '0644'
|
|
content: |
|
|
FROM gitea/runner-images:ubuntu-latest
|
|
|
|
COPY root_ca.crt /usr/local/share/ca-certificates/root_ca.crt
|
|
RUN update-ca-certificates
|
|
|
|
- name: Builder l'image runner avec le CA
|
|
community.docker.docker_image:
|
|
name: gitea.arcodange.lab/arcodange-org/runner-images
|
|
tag: ubuntu-latest-ca
|
|
source: build
|
|
build:
|
|
path: /tmp/gitea-runner-image
|
|
push: true
|
|
|
|
# - /etc/ssl/certs:/etc/ssl/certs:ro
|
|
|
|
# - name: Distribute Step-CA root certificate
|
|
# hosts: all
|
|
# gather_facts: true
|
|
# become: true
|
|
# vars:
|
|
# root_ca_source: "/tmp/step-ca-cert-manager/root_ca.crt"
|
|
# root_ca_filename: "arcodange-root.crt"
|
|
|
|
# tasks:
|
|
# - name: Ensure root CA file is copied to correct location
|
|
# copy:
|
|
# src: "{{ root_ca_source }}"
|
|
# dest: "{{ ca_dest_path }}"
|
|
# owner: root
|
|
# group: root
|
|
# mode: '0644'
|
|
# vars:
|
|
# ca_dest_path: >-
|
|
# {% if ansible_facts['os_family'] == 'Debian' %}
|
|
# /usr/local/share/ca-certificates/{{ root_ca_filename }}
|
|
# {% elif ansible_facts['os_family'] in ['RedHat', 'Fedora'] %}
|
|
# /etc/pki/ca-trust/source/anchors/{{ root_ca_filename }}
|
|
# {% else %}
|
|
# /etc/ssl/certs/{{ root_ca_filename }}
|
|
# {% endif %}
|
|
|
|
# - name: Update CA trust store
|
|
# command: "{{ ca_update_command }}"
|
|
# vars:
|
|
# ca_update_command: >-
|
|
# {% if ansible_facts['os_family'] == 'Debian' %}
|
|
# update-ca-certificates
|
|
# {% elif ansible_facts['os_family'] in ['RedHat', 'Fedora'] %}
|
|
# update-ca-trust
|
|
# {% else %}
|
|
# echo 'Please update the CA trust manually'
|
|
# {% endif %} |