WIP

ansible/play-main.yml

@@ -10,14 +10,15 @@
   hosts: all
   gather_facts: false
   vars_files:
-    - "vars.yml"
+    - "vars/common.yml"
+    - "vars/secrets.yml"
   vars:
     local_ca_common_name: "Lab CA"
-    local_ca_passphrase: "{{ vault.ca.passphrase }}"
-    local_ca_country_name: "FR"
-    local_ca_locality_name: "Vannes"
-    local_ca_organization_name: "iTik"
-    local_ca_email_address: "ca@itik.fr"
+    local_ca_passphrase: "{{ secrets.ca.passphrase }}"
+    local_ca_country_name: "{{ common.certificates.country_name }}"
+    local_ca_locality_name: "{{ common.certificates.locality_name }}"
+    local_ca_organization_name: "{{ common.certificates.organization_name }}"
+    local_ca_email_address: "{{ common.certificates.email_address }}"
   roles:
     - "local_ca"
   tags:
@@ -26,6 +27,9 @@
 - name: Proxy server
   hosts: proxy
   gather_facts: false
+  vars_files:
+    - "vars/common.yml"
+    - "vars/secrets.yml"
   vars:
     squid_authorized_networks:
       - "{{ ansible_default_ipv4.network }}/24"
@@ -38,7 +42,8 @@
   hosts: all
   gather_facts: false
   vars_files:
-    - "vars.yml"
+    - "vars/common.yml"
+    - "vars/secrets.yml"
   vars:
     common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
   roles:
@@ -49,39 +54,66 @@
 - name: HTTP Servers
   hosts: www
   gather_facts: false
+  vars_files:
+    - "vars/common.yml"
+    - "vars/secrets.yml"
   roles:
     - "www"
   tags:
     - "www"
 
-- name: Web Application Firewalls
+- name: Web Application Firewalls (install)
   hosts: waf
   gather_facts: false
   vars_files:
-    - "vars.yml"
+    - "vars/common.yml"
+    - "vars/secrets.yml"
   vars:
-    cert_domains:
-      - "DNS:test.lab"
-      - "DNS:{{ ansible_fqdn }}"
-      - "DNS:{{ ansible_hostname }}"
-      - "IP:{{ ansible_default_ipv4.address }}"
-      - "DNS:server.{{ consul_datacenter }}.{{ consul_domain }}"
-    cert_country_name: "FR"
-    cert_locality_name: "Vannes"
-    cert_organization_name: "iTik"
-    cert_email_address: "ca@itik.fr"
-    consul_domain: "itik.fr"
-    consul_datacenter: "lab"
-    consul_secret_key: "{{ vault.consul.secret_key }}"
+    certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
+    certs_default_country_name: "{{ common.certificates.country_name }}"
+    certs_default_locality_name: "{{ common.certificates.locality_name }}"
+    certs_default_organization_name: "{{ common.certificates.organization_name }}"
+    certs_default_email_address: "{{ common.certificates.email_address }}"
+    certs_list:
+      # Consul
+      - cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
+        domains:
+          - "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
+      # Sites
+      - cn: "test.lab"
+        domains:
+          - "DNS:test.lab"
+          - "DNS:{{ ansible_fqdn }}"
+          - "DNS:{{ ansible_hostname }}"
+          - "IP:{{ ansible_default_ipv4.address }}"
+    consul_domain: "{{ common.consul.domain }}"
+    consul_datacenter: "{{ common.consul.datacenter }}"
+    consul_secret_key: "{{ secrets.consul.secret_key }}"
     consul_nodes:
       - "waf1"
       - "waf2"
       - "waf3"
-    bgwaf_cluster: false
-    bgwaf_sites: "{{ waf.sites }}"
+    # FIXME: -> Cady modules
+    waf_install_cluster: true
+    vip_script_user: "caddy"
+    vip_monitored_process: "caddy"
+    vip_vrrp_password: "{{ secrets.keepalived.secret }}"
+    vip_vrrp_ips:
+      - master: "waf1"
+        virtual_router_id: 11
+        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.250"
+      - master: "waf2"
+        virtual_router_id: 12
+        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.251"
+      - master: "waf3"
+        virtual_router_id: 13
+        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.252"
+    waf_config_sites: "{{ common.sites }}"
   roles:
-    - "cert"
+    - "certs"
     - "consul"
-    - "bgwaf"
+    - "waf_install"
+    - "vip"
+    - "waf_config"
   tags:
-    - "bgwaf"
+    - "waf"