Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Move keyserver to a role. Thanks misc!

Browse source
This commit is contained in:
Kevin Fenzi 2014-04-24 20:37:51 +00:00
parent 0982cd46a9
commit 52c9e9a08d
10 changed files with 103 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

6
handlers/restart_services.yml
View file

@ -80,12 +80,6 @@
- name: restart rsyslog
action: service name=rsyslog state=restarted
- name: restart sks-db
action: service name=sks-db state=restarted
- name: restart sks-recon
action: service name=sks-recon state=restarted
- name: restart sshd
action: service name=sshd state=restarted

2
playbooks/groups/keyserver.yml
View file

@ -38,6 +38,7 @@
- nagios_client
- fas_client
- fedmsg/base
- keyserver
tasks:
- include: "{{ tasks }}/hosts.yml"
@ -47,7 +48,6 @@
- include: "{{ tasks }}/motd.yml"
- include: "{{ tasks }}/sudo.yml"
- include: "{{ tasks }}/apache.yml"
- include: "{{ tasks }}/keyserver.yml"
handlers:
- include: "{{ handlers }}/restart_services.yml"

0
files/keyserver/css.css → roles/keyserver/files/css.css
View file

0
files/keyserver/index.html → roles/keyserver/files/index.html
View file

0
files/keyserver/membership → roles/keyserver/files/membership
View file

83
roles/keyserver/files/sks.conf Normal file
View file

@ -0,0 +1,83 @@
ServerName keys.fedoraproject.org
Listen 80.239.156.219:11371
NameVirtualHost *:443
<ifModule !mod_proxy.c>
LoadModule proxy_module modules/mod_proxy.so
</IfModule>
<IfModule !mod_proxy_http.c>
LoadModule proxy_http_module modules/mod_proxy_http.so
</IfModule>
<IfModule !mod_proxy_balancer.c>
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
</IfModule>
<IfModule !mod_headers.c>
LoadModule headers_module modules/mod_headers.so
</IfModule>
<IfModule !mod_authz_host.c>
LoadModule authz_host_module modules/mod_authz_host.so
</IfModule>
<IfModule !mod_log_config.c>
LoadModule log_config_module modules/mod_log_config.so
</IfModule>
<IfModule !mod_env.c>
LoadModule env_module modules/mod_env.so
</IfModule>
<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
</Directory>
<VirtualHost *:80>
ServerAdmin sysadmin-keys-members@fedoraproject.org
ServerName keys.fedoraproject.org
ProxyPass / http://127.0.0.1:11371/
ProxyPassReverse / http://127.0.0.1:11371/
SetEnv proxy-nokeepalive 1
ProxyVia Full
</VirtualHost>
<VirtualHost *:443>
ServerAdmin sysadmin-keys-members@fedoraproject.org
ServerName keys.fedoraproject.org
ServerAlias keys01.fedoraproject.org
SSLEngine on
SSLCertificateFile /etc/pki/tls/wildcard-2013.fedoraproject.org.cert
SSLCertificateChainFile /etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert
SSLCertificateKeyFile /etc/pki/tls/wildcard-2013.fedoraproject.org.key
ProxyPass / http://localhost:11371/
ProxyPassReverse / http://localhost:11371/
SetEnv proxy-nokeepalive 1
ProxyVia Full
</VirtualHost>
<VirtualHost *:443>
ServerAdmin sysadmin-keys-members@fedoraproject.org
ServerName pool.sks-keyservers.net
ServerAlias sks-keyservers.net
ServerAlias *.sks-keyservers.net
SSLEngine on
SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem
SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key
ProxyPass / http://localhost:11371/
ProxyPassReverse / http://localhost:11371/
SetEnv proxy-nokeepalive 1
ProxyVia Full
</VirtualHost>
<VirtualHost *:11371>
ServerAdmin sysadmin-keys-members@fedoraproject.org
ServerName keys.fedoraproject.org
ProxyPass / http://127.0.0.1:11371/
ProxyPassReverse / http://127.0.0.1:11371/
SetEnv proxy-nokeepalive 1
ProxyVia Full
</VirtualHost>

0
files/keyserver/sksconf → roles/keyserver/files/sksconf
View file

0
files/keyserver/ssl.conf → roles/keyserver/files/ssl.conf
View file

6
roles/keyserver/handlers/main.yml Normal file
View file

@ -0,0 +1,6 @@
- name: restart sks-db
action: service name=sks-db state=restarted
- name: restart sks-recon
action: service name=sks-recon state=restarted

26
tasks/keyserver.yml → roles/keyserver/tasks/main.yml
View file

@ -16,12 +16,12 @@
owner=sks group=sks mode=0755
- name: /srv/sks/membership
copy: src="{{ files }}/keyserver/membership" dest=/srv/sks/membership owner=sks group=sks mode=0644
copy: src="membership" dest=/srv/sks/membership owner=sks group=sks mode=0644
tags:
- config
- name: /srv/sks/sksconf
copy: src="{{ files }}/keyserver/sksconf" dest=/srv/sks/sksconf owner=sks group=sks mode=0644
copy: src="sksconf" dest=/srv/sks/sksconf owner=sks group=sks mode=0644
tags:
- config
@ -32,37 +32,37 @@
owner=sks group=sks mode=0755
- name: /srv/sks/web/index.html
copy: src="{{ files }}/keyserver/index.html" dest=/srv/sks/web/index.html owner=sks group=sks mode=0644
copy: src="index.html" dest=/srv/sks/web/index.html owner=sks group=sks mode=0644
tags:
- config
with_items:
- name: /srv/sks/web/css.css
copy: src="{{ files }}/keyserver/css.css" dest=/srv/sks/web/css.css owner=sks group=sks mode=0644
copy: src="css.css" dest=/srv/sks/web/css.css owner=sks group=sks mode=0644
tags:
- config
- name: /etc/httpd/conf.d/sks.conf
copy: src="{{ files }}/keyserver/sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644
copy: src="sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644
tags:
- config
- name: /etc/httpd/conf.d/ssl.conf
copy: src="{{ files }}/keyserver/ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
copy: src="ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
tags:
- config
- name: /etc/pki/tls/wildcard-2014.fedoraproject.org.cert
copy: src="{{ puppet_private }}/httpd/wildcard-2014.fedoraproject.org.cert" dest=/etc/pki/tls/wildcard-2014.fedoraproject.org.cert owner=root group=root mode=0600
- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.cert
copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.cert" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.cert owner=root group=root mode=0600
tags:
- config
- name: /etc/pki/tls/wildcard-2014.fedoraproject.org.key
copy: src="{{ puppet_private }}/httpd/wildcard-2014.fedoraproject.org.key" dest=/etc/pki/tls/wildcard-2014.fedoraproject.org.key owner=root group=root mode=0600
- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.key
copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.key" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.key owner=root group=root mode=0600
tags:
- config
- name: /etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert
copy: src="{{ puppet_private }}/httpd/wildcard-2014.fedoraproject.org.intermediate.cert" dest=/etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert owner=root group=root mode=0600
- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert
copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.intermediate.cert" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert owner=root group=root mode=0600
tags:
- config