ansible-ffibk/roles/ffmwu-meshing/tasks/fastd-config.yml

74 lines
2.2 KiB
YAML

---
# hash describing community expected as "mf_com";
# also expected: "f_ssh_keyfile" and "mf_com_repo"
- name: clone key repo - {{mf_com.abbreviation}}
git:
dest: "{{mf_com_repo}}"
key_file: "{{f_ssh_keyfile.stdout}}"
repo: "ssh://git@github.com/{{mf_com.repo}}"
update: no
accept_hostkey: yes
# the following is a crude but functional work-around the problem that
# the git module wouldn't clone the repo with the ssh-config-entry
# in the url, but git wouldn't push without it (due to missing
# connection to the ssh key)
- name: change git url to pushable
git_config:
repo: "{{mf_com_repo}}"
scope: local
name: "remote.origin.url"
value: "ssh://github_mwu/{{mf_com.repo}}"
- name: generate fastd key pair - {{mf_com.abbreviation}}
command: fastd --generate-key
creates="/etc/fastd/{{mf_com.abbreviation}}VPN/secret.conf"
register: f_key_pair
- block:
# - debug: var=f_key_pair
- name: write out fastd secret key - {{mf_com.abbreviation}}
lineinfile:
backup: yes
create: yes
dest: "/etc/fastd/{{mf_com.abbreviation}}VPN/secret.conf"
insertbefore: BOF
line: secret "{{f_key_pair.stdout_lines[0] |regex_replace('^Secret. ','')}}";
mode: 0400
regexp: '^secret ".*";'
state: present
- name: write out fastd public key - {{mf_com.abbreviation}}
lineinfile:
create: yes
dest: "{{mf_com_repo}}/servers/{{fastd_alias}}"
insertbefore: BOF
line: key "{{f_key_pair.stdout_lines[1] |regex_replace('^Public. ','')}}";
mode: 0440
regexp: '^key ".*";'
state: present
register: f_pub_key
ignore_errors: True
- name: delete secret in case of public failure - {{mf_com.abbreviation}}
file: path="/etc/fastd/{{mf_com.abbreviation}}VPN/secret.conf" state=absent
when: f_pub_key.failed is defined
- fail: msg="FAILED writing fastd key pair"
when: f_pub_key.failed is defined
when: f_key_pair.changed
# end of block
- name: template out fastd.conf - {{mf_com.abbreviation}}
template:
backup: yes
dest: "/etc/fastd/{{mf_com.abbreviation}}VPN/fastd.conf"
mode: 0640
src: "{{mf_com_templ}}"
validate: 'fastd --verify-config -c %s'