143 lines
4.3 KiB
YAML
143 lines
4.3 KiB
YAML
---
|
|
|
|
- name: Generate self-signed certificate
|
|
import_tasks: ../includes/create_selfsigned_cert.yml
|
|
vars:
|
|
cert_path: "{{ nomad_conf.tls.cert_file }}"
|
|
cert_key_path: "{{ nomad_conf.tls.key_file }}"
|
|
cert_key_group: "{{ nomad_user }}"
|
|
cert_key_mode: 640
|
|
tags: nomad
|
|
|
|
- name: Check if CA exists
|
|
stat: path={{ nomad_conf.tls.ca_file }}
|
|
register: nomad_ca_file
|
|
tags: nomad
|
|
|
|
- name: Copy cert as CA
|
|
copy: src={{ nomad_conf.tls.cert_file }} dest={{ nomad_conf.tls.ca_file }} remote_src=True
|
|
when: not nomad_ca_file.stat.exists
|
|
tags: nomad
|
|
|
|
- name: Deploy nomad configuration
|
|
block:
|
|
- name: Deploy nomad configuration
|
|
template:
|
|
src: nomad.hcl.j2
|
|
dest: "{{ nomad_root_dir }}/etc/nomad.hcl"
|
|
owner: root
|
|
group: "{{ nomad_user }}"
|
|
mode: 0640
|
|
backup: True
|
|
register: nomad_main_conf
|
|
notify: restart nomad
|
|
|
|
- name: Deploy nomad reloadable configuration
|
|
template:
|
|
src: reload.hcl.j2
|
|
dest: "{{ nomad_root_dir }}/etc/reload.hcl"
|
|
owner: root
|
|
group: "{{ nomad_user }}"
|
|
mode: 0640
|
|
backup: True
|
|
register: nomad_reload_conf
|
|
notify: reload nomad
|
|
|
|
- name: Validate configuration
|
|
command: nomad config validate {{ nomad_root_dir }}/etc/nomad.hcl {{ nomad_root_dir }}/etc/reload.hcl
|
|
changed_when: False
|
|
become_user: "{{ nomad_user }}"
|
|
register: nomad_conf_validation
|
|
|
|
rescue:
|
|
- block:
|
|
- name: Restore main configuration
|
|
copy:
|
|
src: "{{ nomad_main_conf.backup_file }}"
|
|
dest: "{{ nomad_root_dir }}/etc/nomad.hcl"
|
|
remote_src: True
|
|
owner: root
|
|
group: "{{ nomad_user }}"
|
|
mode: 0640
|
|
when: nomad_main_conf.backup_file is defined
|
|
|
|
- name: Restore reloadable configuration
|
|
copy:
|
|
src: "{{ nomad_reload_conf.backup_file }}"
|
|
dest: "{{ nomad_root_dir }}/etc/reload.hcl"
|
|
remote_src: True
|
|
owner: root
|
|
group: "{{ nomad_user }}"
|
|
mode: 0640
|
|
when: nomad_reload_conf.backup_file is defined
|
|
|
|
tags: nomad
|
|
|
|
- name: Fail if configuration validation failed
|
|
fail:
|
|
msg: "Failed to validate configuration: {{ nomad_conf_validation.stdout }}"
|
|
when: nomad_conf_validation.rc != 0
|
|
tags: nomad
|
|
|
|
# Now we remove the backup config to prevent nomad warning about invalid config files
|
|
- name: List backup conf
|
|
shell: ls -1 {{ nomad_root_dir }}/etc/*.hcl.*
|
|
failed_when: False
|
|
changed_when: False
|
|
register: nomad_backup_configs
|
|
tags: nomad
|
|
|
|
- name: Remove backup configs
|
|
file: path={{ item }} state=absent
|
|
loop: "{{ nomad_backup_configs.stdout_lines }}"
|
|
tags: nomad
|
|
|
|
- when: nomad_vault_tls.enabled
|
|
block:
|
|
|
|
- name: Deploy consul-template config
|
|
template: src=consul-template.hcl.j2 dest={{ nomad_root_dir }}/consul-template/consul-template.hcl
|
|
notify: restart consul-template-nomad
|
|
|
|
- name: Deploy consul-template agent cert template
|
|
template: src=agent_cert.tpl.j2 dest={{ nomad_root_dir }}/consul-template/{{ item.where }} owner=root group=root
|
|
loop:
|
|
- what: certificate
|
|
where: agent.crt.tpl
|
|
- what: private_key
|
|
where: agent.key.tpl
|
|
- what: issuing_ca
|
|
where: ca.crt.tpl
|
|
notify: restart consul-template-nomad
|
|
|
|
tags: nomad
|
|
|
|
- when: nomad_vault_tls.enabled and nomad_conf.server.enabled
|
|
block:
|
|
|
|
- name: Deploy consul-template cli cert template
|
|
template: src=cli_cert.tpl.j2 dest={{ nomad_root_dir }}/consul-template/{{ item.where }} owner=root group=root
|
|
loop:
|
|
- what: certificate
|
|
where: cli.crt.tpl
|
|
- what: private_key
|
|
where: cli.key.tpl
|
|
notify: restart consul-template-nomad
|
|
|
|
tags: nomad
|
|
|
|
- name: Set ACL on the TLS dir
|
|
shell: |
|
|
setfacl -R -b -x {{ nomad_root_dir }}/tls
|
|
{% if nomad_admin_groups | length > 0 %}
|
|
setfacl -R -m {% for group in nomad_admin_groups %}g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ nomad_root_dir }}/tls
|
|
setfacl -R -m {% for group in nomad_admin_groups %}d:g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ nomad_root_dir }}/tls
|
|
{% endif %}
|
|
changed_when: False
|
|
failed_when: False # Do not fail if eg, the FS doesn't support ACL
|
|
tags: nomad
|
|
|
|
- name: Deploy profile script
|
|
template: src=profile.sh.j2 dest=/etc/profile.d/nomad.sh
|
|
tags: nomad
|