diff options
Diffstat (limited to 'salt')
5 files changed, 31 insertions, 7 deletions
diff --git a/salt/openbook/ansible/files/docker_registry.yaml b/salt/openbook/ansible/files/docker_registry.yaml index 20dfb73..3666deb 100644 --- a/salt/openbook/ansible/files/docker_registry.yaml +++ b/salt/openbook/ansible/files/docker_registry.yaml @@ -33,9 +33,9 @@ - name: "Copy SSL certs into nginx directory" shell: | - cp "/etc/ssl/certs/{{ cn }}.crt" /root/docker-registry/nginx/ - cp "/etc/ssl/certs/{{ cn }}.ca" /root/docker-registry/nginx/ - cp "/etc/ssl/private/{{ cn }}.key" /root/docker-registry/nginx/ + cp "/etc/ssl/certs/{{ inventory_hostname }}.crt" /root/docker-registry/nginx/ + cp "/etc/ssl/certs/{{ inventory_hostname }}.ca" /root/docker-registry/nginx/ + cp "/etc/ssl/private/{{ inventory_hostname }}.key" /root/docker-registry/nginx/ when: ansible_distribution == "Ubuntu" or ansible_distribution == "Gentoo" - name: "Create password file" diff --git a/salt/openbook/ansible/files/env.yaml.docker_registry.example b/salt/openbook/ansible/files/env.yaml.docker_registry.example index f00e29c..f027328 100644 --- a/salt/openbook/ansible/files/env.yaml.docker_registry.example +++ b/salt/openbook/ansible/files/env.yaml.docker_registry.example @@ -7,6 +7,5 @@ globals: environments: - master: - host1: - cn: ~ username: ~ password: ~ diff --git a/salt/openbook/ansible/files/install_docker_registry.yaml b/salt/openbook/ansible/files/install_docker_registry.yaml index f22e643..0a0ad8b 100644 --- a/salt/openbook/ansible/files/install_docker_registry.yaml +++ b/salt/openbook/ansible/files/install_docker_registry.yaml @@ -1,4 +1,5 @@ --- +- include: ssl.yaml - include: docker.yaml - include: docker_compose.yaml - include: docker_registry.yaml diff --git a/salt/openbook/ansible/files/registry.conf b/salt/openbook/ansible/files/registry.conf index e97729a..70ebf7e 100644 --- a/salt/openbook/ansible/files/registry.conf +++ b/salt/openbook/ansible/files/registry.conf @@ -4,12 +4,12 @@ upstream docker-registry { server { listen 443; - server_name {% raw %}{{ cn }}{% endraw %}; + server_name {% raw %}{{ inventory_hostsname }}{% endraw %}; # SSL ssl on; - ssl_certificate /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.crt; - ssl_certificate_key /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.key; + ssl_certificate /etc/nginx/conf.d/{% raw %}{{ inventory_hostsname }}{% endraw %}.crt; + ssl_certificate_key /etc/nginx/conf.d/{% raw %}{{ inventory_hostsname }}{% endraw %}.key; # disable any limits to avoid HTTP 413 for large image uploads client_max_body_size 0; diff --git a/salt/openbook/ansible/files/ssl.yaml b/salt/openbook/ansible/files/ssl.yaml new file mode 100644 index 0000000..6330e87 --- /dev/null +++ b/salt/openbook/ansible/files/ssl.yaml @@ -0,0 +1,24 @@ +--- +- name: "Create self-signed SSL cert" + shell: + cmd: | + if [ ! -f "/etc/ssl/certs/{{ item }}.crt" ] && [ ! -f "/etc/ssl/private/{{ item }}.key" ]; then + openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:4096 -keyout "/tmp/{{ item }}.key" -out "/tmp/{{ item }}.crt" <<EOF + US + New Jersey + Basking Ridge + Verizon Wireless + Verizon Cloud Platform + {{ item }} + carlos.konstanski@verizonwireless.com + EOF + cp -f "/tmp/{{ item }}.crt" "/etc/ssl/certs/" + cp -f "/tmp/{{ item }}.key" "/etc/ssl/private/" + chmod 644 "/etc/ssl/certs/{{ item }}.crt" + chown root: "/etc/ssl/certs/{{ item }}.crt" + chmod 640 "/etc/ssl/private/{{ item }}.key" + chown root:ssl-cert "/etc/ssl/private/{{ item }}.key" + fi + executable: /bin/bash + with_items: + - "{{ inventory_hostname }}" |