Openbook CI: make new self-signed cert for CI/CD stack

Issue: IS-56

6 files changed, 37 insertions, 7 deletions

diff --git a/pillar/openbook/ansible.sls b/pillar/openbook/ansible.sls
index 63699b5..a579f03 100644
--- a/pillar/openbook/ansible.sls
+++ b/pillar/openbook/ansible.sls
@@ -165,6 +165,12 @@ ansible:
       mode: "0644"
       relative_to_buildroot: True
       is_template: False
+    ssl_yaml:
+      name: files/ssl.yaml
+      source: ssl.yaml
+      mode: "0644"
+      relative_to_buildroot: True
+      is_template: False
     slave_jar:
       name: files/slave.jar
       source: slave.jar
diff --git a/salt/openbook/ansible/files/docker_registry.yaml b/salt/openbook/ansible/files/docker_registry.yaml
index 20dfb73..3666deb 100644
--- a/salt/openbook/ansible/files/docker_registry.yaml
+++ b/salt/openbook/ansible/files/docker_registry.yaml
@@ -33,9 +33,9 @@
 
     - name: "Copy SSL certs into nginx directory"
       shell: |
-        cp "/etc/ssl/certs/{{ cn }}.crt" /root/docker-registry/nginx/
-        cp "/etc/ssl/certs/{{ cn }}.ca" /root/docker-registry/nginx/
-        cp "/etc/ssl/private/{{ cn }}.key" /root/docker-registry/nginx/
+        cp "/etc/ssl/certs/{{ inventory_hostname }}.crt" /root/docker-registry/nginx/
+        cp "/etc/ssl/certs/{{ inventory_hostname }}.ca" /root/docker-registry/nginx/
+        cp "/etc/ssl/private/{{ inventory_hostname }}.key" /root/docker-registry/nginx/
       when: ansible_distribution == "Ubuntu" or ansible_distribution == "Gentoo"
 
     - name: "Create password file"
diff --git a/salt/openbook/ansible/files/env.yaml.docker_registry.example b/salt/openbook/ansible/files/env.yaml.docker_registry.example
index f00e29c..f027328 100644
--- a/salt/openbook/ansible/files/env.yaml.docker_registry.example
+++ b/salt/openbook/ansible/files/env.yaml.docker_registry.example
@@ -7,6 +7,5 @@ globals:
 environments:
   - master:
       - host1:
-          cn: ~
           username: ~
           password: ~
diff --git a/salt/openbook/ansible/files/install_docker_registry.yaml b/salt/openbook/ansible/files/install_docker_registry.yaml
index f22e643..0a0ad8b 100644
--- a/salt/openbook/ansible/files/install_docker_registry.yaml
+++ b/salt/openbook/ansible/files/install_docker_registry.yaml
@@ -1,4 +1,5 @@
 ---
+- include: ssl.yaml
 - include: docker.yaml
 - include: docker_compose.yaml
 - include: docker_registry.yaml
diff --git a/salt/openbook/ansible/files/registry.conf b/salt/openbook/ansible/files/registry.conf
index e97729a..70ebf7e 100644
--- a/salt/openbook/ansible/files/registry.conf
+++ b/salt/openbook/ansible/files/registry.conf
@@ -4,12 +4,12 @@ upstream docker-registry {
 
 server {
   listen 443;
-  server_name {% raw %}{{ cn }}{% endraw %};
+  server_name {% raw %}{{ inventory_hostsname }}{% endraw %};
 
   # SSL
   ssl on;
-  ssl_certificate /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.crt;
-  ssl_certificate_key /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.key;
+  ssl_certificate /etc/nginx/conf.d/{% raw %}{{ inventory_hostsname }}{% endraw %}.crt;
+  ssl_certificate_key /etc/nginx/conf.d/{% raw %}{{ inventory_hostsname }}{% endraw %}.key;
 
   # disable any limits to avoid HTTP 413 for large image uploads
   client_max_body_size 0;
diff --git a/salt/openbook/ansible/files/ssl.yaml b/salt/openbook/ansible/files/ssl.yaml
new file mode 100644
index 0000000..6330e87
--- /dev/null
+++ b/salt/openbook/ansible/files/ssl.yaml
@@ -0,0 +1,24 @@
+---
+- name: "Create self-signed SSL cert"
+  shell:
+    cmd: |
+      if [ ! -f "/etc/ssl/certs/{{ item }}.crt" ] && [ ! -f "/etc/ssl/private/{{ item }}.key" ]; then
+          openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:4096 -keyout "/tmp/{{ item }}.key" -out "/tmp/{{ item }}.crt" <<EOF
+      US
+      New Jersey
+      Basking Ridge
+      Verizon Wireless
+      Verizon Cloud Platform
+      {{ item }}
+      carlos.konstanski@verizonwireless.com
+      EOF
+          cp -f "/tmp/{{ item }}.crt" "/etc/ssl/certs/"
+          cp -f "/tmp/{{ item }}.key" "/etc/ssl/private/"
+          chmod 644 "/etc/ssl/certs/{{ item }}.crt"
+          chown root: "/etc/ssl/certs/{{ item }}.crt"
+          chmod 640 "/etc/ssl/private/{{ item }}.key"
+          chown root:ssl-cert "/etc/ssl/private/{{ item }}.key"
+      fi
+    executable: /bin/bash
+    with_items:
+      - "{{ inventory_hostname }}"