From 0a36e7074f06c45e5ca79c56610df02a9944a580 Mon Sep 17 00:00:00 2001 From: Adw8 Date: Fri, 27 Sep 2024 13:03:36 +0530 Subject: [PATCH] Add playbook to setup gpg key --- service-provider-setup/README.md | 9 +- service-provider-setup/deploy-backend.yml | 6 +- service-provider-setup/deploy-frontend.yml | 4 + .../run-laconic-console.yml | 4 + service-provider-setup/run-laconicd.yml | 6 + .../service-provider-setup.yml | 2 + .../setup-container-registry.yml | 4 + service-provider-setup/setup-k8s.yml | 7 +- service-provider-setup/setup-system.yml | 138 ++++++++++++++++++ service-provider-setup/setup-user.yml | 78 +--------- 10 files changed, 177 insertions(+), 81 deletions(-) create mode 100644 service-provider-setup/setup-system.yml diff --git a/service-provider-setup/README.md b/service-provider-setup/README.md index bd6be04..c3050a5 100644 --- a/service-provider-setup/README.md +++ b/service-provider-setup/README.md @@ -62,6 +62,7 @@ To get started, follow the [installation](../README.md#installation) guide to se - Execute the `setup-user.yml` Ansible playbook to create a user with passwordless sudo permissions: ```bash + cd ../ ansible-playbook setup-user.yml -i hosts.ini --extra-vars='{ "target_host": "deployment_host" }' ``` @@ -102,6 +103,7 @@ To get started, follow the [installation](../README.md#installation) guide to se ```bash cd vars cp dns-vars.example.yml dns-vars.yml + cp gpg-vars.example.yml gpg-vars.yml cp k8s-vars.example.yml k8s-vars.yml cp container-vars.example.yml container-vars.yml cp webapp-vars.example.yml webapp-vars.yml @@ -116,10 +118,13 @@ To get started, follow the [installation](../README.md#installation) guide to se cluster_control_ip: "" # eg: 23.111.78.179 do_api_token: "" # eg: dop_v1... + # vars/gpg-vars.yml + gpg_user_name: "" # Full name of the user for the GPG key + gpg_user_email: "" # Email address associated with the GPG key + gpg_passphrase: "" # Passphrase for securing the GPG key + # vars/k8s-vars.yml target_host: "deployment_host" - gpg_key_id: "" # The sequence obtained in the previous step, eg: 0AFB10B643944C22 - vault_passphrase: "" # passphrase for GPG key org_id: "" # eg: lcn location_id: "" # eg: cad base_domain: "" # eg: laconic diff --git a/service-provider-setup/deploy-backend.yml b/service-provider-setup/deploy-backend.yml index 679328a..dae513d 100644 --- a/service-provider-setup/deploy-backend.yml +++ b/service-provider-setup/deploy-backend.yml @@ -10,6 +10,10 @@ - vars/container-vars.yml - vars/k8s-vars.yml - vars/dns-vars.yml + - vars/user-vars.yml + + become: yes + become_user: "{{username}}" tasks: - name: Ensure gpg-keys directory exists @@ -63,7 +67,7 @@ -v /home/{{ ansible_user }}/config:/home/root/config \ cerc/webapp-deployer-backend:local laconic-so publish-deployer-to-registry \ --laconic-config /home/root/config/laconic.yml \ - --api-url https://webapp-deployer-api.{{ full_domain }} \ + --api-url https://webapp-deployer-api.pwa.{{ full_domain }} \ --public-key-file /home/root/config/webapp-deployer-api.{{ full_domain }}.pgp.pub \ --lrn lrn://{{ authority_name }}/deployers/webapp-deployer-api.{{ full_domain }} \ --min-required-payment 100 diff --git a/service-provider-setup/deploy-frontend.yml b/service-provider-setup/deploy-frontend.yml index 59a8318..e45fbf4 100644 --- a/service-provider-setup/deploy-frontend.yml +++ b/service-provider-setup/deploy-frontend.yml @@ -8,6 +8,10 @@ - vars/webapp-vars.yml - vars/dns-vars.yml - vars/k8s-vars.yml + - vars/user-vars.yml + + become: yes + become_user: "{{username}}" tasks: - name: Clone webapp-deployment-status-ui repository diff --git a/service-provider-setup/run-laconic-console.yml b/service-provider-setup/run-laconic-console.yml index 43655e7..d28e617 100644 --- a/service-provider-setup/run-laconic-console.yml +++ b/service-provider-setup/run-laconic-console.yml @@ -8,6 +8,10 @@ - vars/webapp-vars.yml - vars/dns-vars.yml - vars/k8s-vars.yml + - vars/user-vars.yml + + become: yes + become_user: "{{username}}" tasks: - name: Clone the stack repo diff --git a/service-provider-setup/run-laconicd.yml b/service-provider-setup/run-laconicd.yml index a148ca9..71ddf42 100644 --- a/service-provider-setup/run-laconicd.yml +++ b/service-provider-setup/run-laconicd.yml @@ -4,6 +4,12 @@ environment: PATH: "{{ ansible_env.PATH }}:/home/{{ansible_user}}/bin" + vars_files: + - vars/user-vars.yml + + become: yes + become_user: "{{username}}" + tasks: - name: Clone the fixturenet-laconicd-stack repo command: laconic-so fetch-stack git.vdb.to/cerc-io/fixturenet-laconicd-stack --pull diff --git a/service-provider-setup/service-provider-setup.yml b/service-provider-setup/service-provider-setup.yml index a50564d..5af93ab 100644 --- a/service-provider-setup/service-provider-setup.yml +++ b/service-provider-setup/service-provider-setup.yml @@ -1,4 +1,6 @@ +- import_playbook: setup-user.yml - import_playbook: setup-dns.yml +- import_playbook: setup-system.yml - import_playbook: setup-k8s.yml - import_playbook: setup-container-registry.yml - import_playbook: run-laconicd.yml diff --git a/service-provider-setup/setup-container-registry.yml b/service-provider-setup/setup-container-registry.yml index 7b227e3..3786e91 100644 --- a/service-provider-setup/setup-container-registry.yml +++ b/service-provider-setup/setup-container-registry.yml @@ -8,7 +8,11 @@ - vars/k8s-vars.yml - vars/container-vars.yml - vars/dns-vars.yml + - vars/user-vars.yml + become: yes + become_user: "{{username}}" + tasks: - name: Generate spec file for the container-registry stack template: diff --git a/service-provider-setup/setup-k8s.yml b/service-provider-setup/setup-k8s.yml index ba15ed6..56a60ce 100644 --- a/service-provider-setup/setup-k8s.yml +++ b/service-provider-setup/setup-k8s.yml @@ -9,8 +9,13 @@ VAULT_KEY: "{{ vault_passphrase }}" vars_files: - - vars/k8s-vars.yml - vars/dns-vars.yml + - vars/gpg-vars.yml + - vars/k8s-vars.yml + - vars/user-vars.yml + + become: yes + become_user: "{{username}}" tasks: - name: Install Python and pip diff --git a/service-provider-setup/setup-system.yml b/service-provider-setup/setup-system.yml new file mode 100644 index 0000000..b45a8e7 --- /dev/null +++ b/service-provider-setup/setup-system.yml @@ -0,0 +1,138 @@ +- name: Setup system for the service provider setup + hosts: "{{ target_host }}" + + environment: + GNUPGHOME: /home/{{ ansible_user }}/.gnupg + + vars_files: + - vars/k8s-vars.yml + - vars/dns-vars.yml + - vars/gpg-vars.yml + - vars/user-vars.yml + + become: yes + become_user: "{{username}}" + + tasks: + - name: Install required packages + apt: + name: + - doas + - zsh + - tmux + - git + - jq + - acl + - curl + - wget + - netcat-traditional + - fping + - rsync + - htop + - iotop + - iftop + - tar + - less + - firewalld + - sshguard + - wireguard + - iproute2 + - iperf3 + - zfsutils-linux + - net-tools + - ca-certificates + - gnupg + - sshpass + - apache2-utils + state: latest + update_cache: true + become: yes + + - name: Set unique hostname + hostname: + name: "{{ inventory_hostname }}" + when: ansible_hostname != inventory_hostname + + - name: Verify status of firewalld and enable sshguard + systemd: + name: "{{ item }}" + enabled: yes + state: started + loop: + - firewalld + - sshguard + ignore_errors: yes + + - name: Disable and remove snapd + block: + - name: Disable snapd services + systemd: + name: "{{ item }}" + enabled: no + state: stopped + loop: + - snapd.service + - snapd.socket + - snapd.seeded + - snapd.snap-repair.timer + ignore_errors: yes + + - name: Purge snapd + apt: + name: snapd + state: absent + + - name: Remove snap directories + file: + path: "{{ item }}" + state: absent + loop: + - "{{ ansible_env.HOME }}/snap" + - /snap + - /var/snap + - /var/lib/snapd + become: yes + ignore_errors: yes + + - name: Ensure GPG directory exists + file: + path: "{{ ansible_env.HOME }}/.gnupg" + state: directory + mode: '0700' + + - name: Create GPG key parameters file + copy: + dest: /tmp/gpg_key_params.txt + content: | + Key-Type: RSA + Key-Length: 4096 + Subkey-Type: RSA + Name-Real: {{ gpg_user_name }} + Name-Email: {{ gpg_user_email }} + Expire-Date: 0 + Passphrase: {{ gpg_passphrase }} + %no-protection + %commit + mode: '0600' + + - name: Generate GPG key using the parameter file + command: gpg --batch --gen-key /tmp/gpg_key_params.txt + become_user: "{{ ansible_user }}" + register: gpg_keygen_output + ignore_errors: yes + + - name: Show GPG key generation output + debug: + var: gpg_keygen_output.stdout + + - name: Fetch the Key ID of the most recently created GPG key + shell: gpg --list-secret-keys --keyid-format=long | grep 'sec' | tail -n 1 | awk -F'/' '{print $2}' | awk '{print $1}' + register: gpg_key_output + + - name: Set the GPG key ID to a variable + set_fact: + sec_key_id: "{{ gpg_key_output.stdout }}" + + - name: Show GPG Key ID + debug: + msg: "GPG Key ID: {{ sec_key_id }}" diff --git a/service-provider-setup/setup-user.yml b/service-provider-setup/setup-user.yml index 7597c0c..52533ea 100644 --- a/service-provider-setup/setup-user.yml +++ b/service-provider-setup/setup-user.yml @@ -6,82 +6,6 @@ - vars/user-vars.yml tasks: - - name: Set unique hostname - hostname: - name: "{{ inventory_hostname }}" - when: ansible_hostname != inventory_hostname - - # TODO: Move installation to k8s playbook - - name: Install additional packages - apt: - name: - - doas - - zsh - - tmux - - git - - jq - - acl - - curl - - wget - - netcat-traditional - - fping - - rsync - - htop - - iotop - - iftop - - tar - - less - - firewalld - - sshguard - - wireguard - - iproute2 - - iperf3 - - zfsutils-linux - - net-tools - - ca-certificates - - gnupg - - sshpass - state: latest - update_cache: true - - - name: Verify status of firewalld and enable sshguard - systemd: - name: "{{ item }}" - enabled: yes - state: started - loop: - - firewalld - - sshguard - - - name: Disable and remove snapd - block: - - name: Disable snapd services - systemd: - name: "{{ item }}" - enabled: no - state: stopped - loop: - - snapd.service - - snapd.socket - - snapd.seeded - - snapd.snap-repair.timer - - - name: Purge snapd - apt: - name: snapd - state: absent - - - name: Remove snap directories - file: - path: "{{ item }}" - state: absent - loop: - - "{{ ansible_env.HOME }}/snap" - - /snap - - /var/snap - - /var/lib/snapd - become: yes - - name: Create a user user: name: "{{ username }}" @@ -97,7 +21,7 @@ - name: Ensure .ssh directory exists for user file: - path: /home/"{{ username }}"/.ssh + path: /home/{{ username }}/.ssh state: directory owner: "{{ username }}" group: "{{ username }}"