|
|
@ -1,8 +1,14 @@
|
|
|
|
- name: Gather Facts
|
|
|
|
- name: Gather Facts
|
|
|
|
setup:
|
|
|
|
setup:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- name: Generate password for the CA key
|
|
|
|
|
|
|
|
shell: >
|
|
|
|
|
|
|
|
< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-12};echo;
|
|
|
|
|
|
|
|
register: CA_password
|
|
|
|
|
|
|
|
|
|
|
|
- set_fact:
|
|
|
|
- set_fact:
|
|
|
|
easyrsa_p12_export_password: "{{ (ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0] }}"
|
|
|
|
easyrsa_p12_export_password: "{{ (ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0] }}"
|
|
|
|
|
|
|
|
easyrsa_CA_password: "{{ CA_password.stdout }}"
|
|
|
|
|
|
|
|
|
|
|
|
- name: Install StrongSwan
|
|
|
|
- name: Install StrongSwan
|
|
|
|
apt: name=strongswan state=latest update_cache=yes
|
|
|
|
apt: name=strongswan state=latest update_cache=yes
|
|
|
@ -89,7 +95,10 @@
|
|
|
|
with_items: "{{ strongswan_plugins.stdout_lines }}"
|
|
|
|
with_items: "{{ strongswan_plugins.stdout_lines }}"
|
|
|
|
|
|
|
|
|
|
|
|
- name: Fetch easy-rsa-ipsec from git
|
|
|
|
- name: Fetch easy-rsa-ipsec from git
|
|
|
|
git: repo=git://github.com/ValdikSS/easy-rsa-ipsec.git version=ed4de10d7ce0726357fb1bb4729f8eb440c06e2b dest="{{ easyrsa_dir }}"
|
|
|
|
git:
|
|
|
|
|
|
|
|
repo: git://github.com/ValdikSS/easy-rsa-ipsec.git
|
|
|
|
|
|
|
|
version: ipsec-with-patches
|
|
|
|
|
|
|
|
dest: "{{ easyrsa_dir }}"
|
|
|
|
|
|
|
|
|
|
|
|
- name: Setup the vars file from our template
|
|
|
|
- name: Setup the vars file from our template
|
|
|
|
template: src=easy-rsa.vars.j2 dest={{ easyrsa_dir }}/easyrsa3/vars
|
|
|
|
template: src=easy-rsa.vars.j2 dest={{ easyrsa_dir }}/easyrsa3/vars
|
|
|
@ -108,7 +117,7 @@
|
|
|
|
|
|
|
|
|
|
|
|
- name: Build the CA pair
|
|
|
|
- name: Build the CA pair
|
|
|
|
shell: >
|
|
|
|
shell: >
|
|
|
|
./easyrsa build-ca nopass &&
|
|
|
|
./easyrsa --batch build-ca -- -passout pass:"{{ easyrsa_CA_password }}" &&
|
|
|
|
touch {{ easyrsa_dir }}/easyrsa3/pki/ca_initialized
|
|
|
|
touch {{ easyrsa_dir }}/easyrsa3/pki/ca_initialized
|
|
|
|
args:
|
|
|
|
args:
|
|
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
|
@ -118,7 +127,8 @@
|
|
|
|
|
|
|
|
|
|
|
|
- name: Build the server pair
|
|
|
|
- name: Build the server pair
|
|
|
|
shell: >
|
|
|
|
shell: >
|
|
|
|
./easyrsa --subject-alt-name='DNS:{{ IP_subject_alt_name }},IP:{{ IP_subject_alt_name }}' build-server-full {{ IP_subject_alt_name }} nopass &&
|
|
|
|
./easyrsa gen-req {{ IP_subject_alt_name }} batch nopass -- -passin pass:qwe1 -subj "/CN={{ IP_subject_alt_name }}" &&
|
|
|
|
|
|
|
|
./easyrsa --subject-alt-name='DNS:{{ IP_subject_alt_name }},IP:{{ IP_subject_alt_name }}' sign-req server {{ IP_subject_alt_name }} -- -passin pass:"{{ easyrsa_CA_password }}" &&
|
|
|
|
touch '{{ easyrsa_dir }}/easyrsa3/pki/server_initialized'
|
|
|
|
touch '{{ easyrsa_dir }}/easyrsa3/pki/server_initialized'
|
|
|
|
args:
|
|
|
|
args:
|
|
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
|
@ -128,7 +138,8 @@
|
|
|
|
|
|
|
|
|
|
|
|
- name: Build the client's pair
|
|
|
|
- name: Build the client's pair
|
|
|
|
shell: >
|
|
|
|
shell: >
|
|
|
|
./easyrsa build-client-full {{ item }} nopass &&
|
|
|
|
./easyrsa gen-req {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" &&
|
|
|
|
|
|
|
|
./easyrsa --subject-alt-name='DNS:{{ item }}' sign-req client {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" &&
|
|
|
|
touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
|
|
|
|
touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
|
|
|
|
args:
|
|
|
|
args:
|
|
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
|
|