diff options
| -rw-r--r-- | pillar/openbook/ansible.sls | 6 | ||||
| -rw-r--r-- | salt/openbook/ansible/files/docker_registry.yaml | 6 | ||||
| -rw-r--r-- | salt/openbook/ansible/files/env.yaml.docker_registry.example | 1 | ||||
| -rw-r--r-- | salt/openbook/ansible/files/install_docker_registry.yaml | 1 | ||||
| -rw-r--r-- | salt/openbook/ansible/files/registry.conf | 6 | ||||
| -rw-r--r-- | salt/openbook/ansible/files/ssl.yaml | 24 |
6 files changed, 37 insertions, 7 deletions
diff --git a/pillar/openbook/ansible.sls b/pillar/openbook/ansible.sls index 63699b5..a579f03 100644 --- a/pillar/openbook/ansible.sls +++ b/pillar/openbook/ansible.sls @@ -165,6 +165,12 @@ ansible: mode: "0644" relative_to_buildroot: True is_template: False + ssl_yaml: + name: files/ssl.yaml + source: ssl.yaml + mode: "0644" + relative_to_buildroot: True + is_template: False slave_jar: name: files/slave.jar source: slave.jar diff --git a/salt/openbook/ansible/files/docker_registry.yaml b/salt/openbook/ansible/files/docker_registry.yaml index 20dfb73..3666deb 100644 --- a/salt/openbook/ansible/files/docker_registry.yaml +++ b/salt/openbook/ansible/files/docker_registry.yaml @@ -33,9 +33,9 @@ - name: "Copy SSL certs into nginx directory" shell: | - cp "/etc/ssl/certs/{{ cn }}.crt" /root/docker-registry/nginx/ - cp "/etc/ssl/certs/{{ cn }}.ca" /root/docker-registry/nginx/ - cp "/etc/ssl/private/{{ cn }}.key" /root/docker-registry/nginx/ + cp "/etc/ssl/certs/{{ inventory_hostname }}.crt" /root/docker-registry/nginx/ + cp "/etc/ssl/certs/{{ inventory_hostname }}.ca" /root/docker-registry/nginx/ + cp "/etc/ssl/private/{{ inventory_hostname }}.key" /root/docker-registry/nginx/ when: ansible_distribution == "Ubuntu" or ansible_distribution == "Gentoo" - name: "Create password file" diff --git a/salt/openbook/ansible/files/env.yaml.docker_registry.example b/salt/openbook/ansible/files/env.yaml.docker_registry.example index f00e29c..f027328 100644 --- a/salt/openbook/ansible/files/env.yaml.docker_registry.example +++ b/salt/openbook/ansible/files/env.yaml.docker_registry.example @@ -7,6 +7,5 @@ globals: environments: - master: - host1: - cn: ~ username: ~ password: ~ diff --git a/salt/openbook/ansible/files/install_docker_registry.yaml b/salt/openbook/ansible/files/install_docker_registry.yaml index f22e643..0a0ad8b 100644 --- a/salt/openbook/ansible/files/install_docker_registry.yaml +++ b/salt/openbook/ansible/files/install_docker_registry.yaml @@ -1,4 +1,5 @@ --- +- include: ssl.yaml - include: docker.yaml - include: docker_compose.yaml - include: docker_registry.yaml diff --git a/salt/openbook/ansible/files/registry.conf b/salt/openbook/ansible/files/registry.conf index e97729a..70ebf7e 100644 --- a/salt/openbook/ansible/files/registry.conf +++ b/salt/openbook/ansible/files/registry.conf @@ -4,12 +4,12 @@ upstream docker-registry { server { listen 443; - server_name {% raw %}{{ cn }}{% endraw %}; + server_name {% raw %}{{ inventory_hostsname }}{% endraw %}; # SSL ssl on; - ssl_certificate /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.crt; - ssl_certificate_key /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.key; + ssl_certificate /etc/nginx/conf.d/{% raw %}{{ inventory_hostsname }}{% endraw %}.crt; + ssl_certificate_key /etc/nginx/conf.d/{% raw %}{{ inventory_hostsname }}{% endraw %}.key; # disable any limits to avoid HTTP 413 for large image uploads client_max_body_size 0; diff --git a/salt/openbook/ansible/files/ssl.yaml b/salt/openbook/ansible/files/ssl.yaml new file mode 100644 index 0000000..6330e87 --- /dev/null +++ b/salt/openbook/ansible/files/ssl.yaml @@ -0,0 +1,24 @@ +--- +- name: "Create self-signed SSL cert" + shell: + cmd: | + if [ ! -f "/etc/ssl/certs/{{ item }}.crt" ] && [ ! -f "/etc/ssl/private/{{ item }}.key" ]; then + openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:4096 -keyout "/tmp/{{ item }}.key" -out "/tmp/{{ item }}.crt" <<EOF + US + New Jersey + Basking Ridge + Verizon Wireless + Verizon Cloud Platform + {{ item }} + carlos.konstanski@verizonwireless.com + EOF + cp -f "/tmp/{{ item }}.crt" "/etc/ssl/certs/" + cp -f "/tmp/{{ item }}.key" "/etc/ssl/private/" + chmod 644 "/etc/ssl/certs/{{ item }}.crt" + chown root: "/etc/ssl/certs/{{ item }}.crt" + chmod 640 "/etc/ssl/private/{{ item }}.key" + chown root:ssl-cert "/etc/ssl/private/{{ item }}.key" + fi + executable: /bin/bash + with_items: + - "{{ inventory_hostname }}" |