mirror of https://github.com/trailofbits/algo
PKI to tmpfs (#1496)
* PKI to tmpfs * Fixes - diskutil to full path - unmount and eject fixes * Umount fix * run diskutil info only on Darwin kernels * fix shell taskspull/1518/head
parent
f986811d64
commit
090a60d48d
@ -0,0 +1,5 @@
|
||||
---
|
||||
- name: Linux | set OS specific facts
|
||||
set_fact:
|
||||
tmpfs_volume_name: "AlgoVPN-{{ IP_subject_alt_name }}"
|
||||
tmpfs_volume_path: /dev/shm
|
@ -0,0 +1,12 @@
|
||||
---
|
||||
- name: MacOS | set OS specific facts
|
||||
set_fact:
|
||||
tmpfs_volume_name: "AlgoVPN-{{ IP_subject_alt_name }}"
|
||||
tmpfs_volume_path: /Volumes
|
||||
|
||||
- name: MacOS | mount a ram disk
|
||||
shell: >
|
||||
/usr/sbin/diskutil info "/{{ tmpfs_volume_path }}/{{ tmpfs_volume_name }}/" ||
|
||||
/usr/sbin/diskutil erasevolume HFS+ "{{ tmpfs_volume_name }}" $(hdiutil attach -nomount ram://64000)
|
||||
args:
|
||||
creates: "/{{ tmpfs_volume_path }}/{{ tmpfs_volume_name }}"
|
@ -0,0 +1,19 @@
|
||||
---
|
||||
- name: Include tasks for MacOS
|
||||
import_tasks: macos.yml
|
||||
when: ansible_system == "Darwin"
|
||||
|
||||
- name: Include tasks for Linux
|
||||
import_tasks: linux.yml
|
||||
when: ansible_system == "Linux"
|
||||
|
||||
- name: Set config paths as facts
|
||||
set_fact:
|
||||
wireguard_pki_path: "/{{ tmpfs_volume_path }}/{{ tmpfs_volume_name }}/WireGuard/"
|
||||
ipsec_pki_path: "/{{ tmpfs_volume_path }}/{{ tmpfs_volume_name }}/IPsec/"
|
||||
|
||||
- name: Update config paths
|
||||
add_host:
|
||||
name: "{{ 'localhost' if cloud_instance_ip == 'localhost' else cloud_instance_ip }}"
|
||||
wireguard_pki_path: "{{ wireguard_pki_path }}"
|
||||
ipsec_pki_path: "{{ ipsec_pki_path }}"
|
@ -0,0 +1,26 @@
|
||||
---
|
||||
- name: Linux | Delete the PKI directory
|
||||
file:
|
||||
path: "/{{ facts.tmpfs_volume_path }}/{{ facts.tmpfs_volume_name }}/"
|
||||
state: absent
|
||||
when: facts.ansible_system == "Linux"
|
||||
|
||||
- block:
|
||||
- name: MacOS | check fs the ramdisk exists
|
||||
command: /usr/sbin/diskutil info "{{ facts.tmpfs_volume_name }}"
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
register: diskutil_info
|
||||
|
||||
- name: MacOS | unmount and eject the ram disk
|
||||
shell: >
|
||||
/usr/sbin/diskutil umount force "/{{ facts.tmpfs_volume_path }}/{{ facts.tmpfs_volume_name }}/" &&
|
||||
/usr/sbin/diskutil eject "{{ facts.tmpfs_volume_name }}"
|
||||
changed_when: false
|
||||
when: diskutil_info.rc == 0
|
||||
register: result
|
||||
until: result.rc == 0
|
||||
retries: 5
|
||||
delay: 3
|
||||
when:
|
||||
- facts.ansible_system == "Darwin"
|
Loading…
Reference in New Issue