120 lines
3.3 KiB
YAML
120 lines
3.3 KiB
YAML
- name: Gather facts (implicit) and packages facts
|
|
hosts: all
|
|
tasks:
|
|
- name: Gather packages facts
|
|
ansible.builtin.package_facts:
|
|
tags:
|
|
- "always"
|
|
|
|
- name: Create local CA
|
|
hosts: all
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
local_ca_common_name: "Lab CA"
|
|
local_ca_passphrase: "{{ secrets.ca.passphrase }}"
|
|
local_ca_country_name: "{{ common.certificates.country_name }}"
|
|
local_ca_locality_name: "{{ common.certificates.locality_name }}"
|
|
local_ca_organization_name: "{{ common.certificates.organization_name }}"
|
|
local_ca_email_address: "{{ common.certificates.email_address }}"
|
|
roles:
|
|
- "local_ca"
|
|
tags:
|
|
- "local_ca"
|
|
|
|
- name: Proxy server
|
|
hosts: proxy
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
squid_authorized_networks:
|
|
- "{{ ansible_default_ipv4.network }}/24"
|
|
roles:
|
|
- "squid"
|
|
tags:
|
|
- "proxy"
|
|
|
|
- name: Common
|
|
hosts: all
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
|
|
roles:
|
|
- "common"
|
|
tags:
|
|
- "common"
|
|
|
|
- name: HTTP Servers
|
|
hosts: www
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
roles:
|
|
- "www"
|
|
tags:
|
|
- "www"
|
|
|
|
- name: Web Application Firewalls (install)
|
|
hosts: waf
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
|
|
certs_default_country_name: "{{ common.certificates.country_name }}"
|
|
certs_default_locality_name: "{{ common.certificates.locality_name }}"
|
|
certs_default_organization_name: "{{ common.certificates.organization_name }}"
|
|
certs_default_email_address: "{{ common.certificates.email_address }}"
|
|
certs_list:
|
|
# Consul
|
|
- cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
|
|
domains:
|
|
- "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
|
|
# Sites
|
|
- cn: "test.lab"
|
|
domains:
|
|
- "DNS:test.lab"
|
|
- "DNS:{{ ansible_fqdn }}"
|
|
- "DNS:{{ ansible_hostname }}"
|
|
- "IP:{{ ansible_default_ipv4.address }}"
|
|
consul_domain: "{{ common.consul.domain }}"
|
|
consul_datacenter: "{{ common.consul.datacenter }}"
|
|
consul_secret_key: "{{ secrets.consul.secret_key }}"
|
|
consul_nodes:
|
|
- "waf1"
|
|
- "waf2"
|
|
- "waf3"
|
|
# FIXME: -> Cady modules
|
|
waf_install_cluster: true
|
|
vip_script_user: "caddy"
|
|
vip_monitored_process: "caddy"
|
|
vip_vrrp_password: "{{ secrets.keepalived.secret }}"
|
|
vip_vrrp_ips:
|
|
- master: "waf1"
|
|
virtual_router_id: 11
|
|
addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.250"
|
|
- master: "waf2"
|
|
virtual_router_id: 12
|
|
addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.251"
|
|
- master: "waf3"
|
|
virtual_router_id: 13
|
|
addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.252"
|
|
waf_config_sites: "{{ common.sites }}"
|
|
roles:
|
|
- "certs"
|
|
- "consul"
|
|
- "waf_install"
|
|
- "vip"
|
|
- "waf_config"
|
|
tags:
|
|
- "waf"
|