Bulk update

Signed-off-by: Georg Pfuetzenreuter <georg@lysergic.dev>

19 files changed, 174 insertions, 12 deletions

diff --git a/ansible/deployment_poc/tasks/configure_dns.yml b/ansible/deployment_poc/tasks/configure_dns.yml
index 6f1896c..9a28800 100644
--- a/ansible/deployment_poc/tasks/configure_dns.yml
+++ b/ansible/deployment_poc/tasks/configure_dns.yml
@@ -5,6 +5,8 @@
     set_fact:
       dns_fqdn: "{{ lookup('community.general.dig', dns_ip + '/PTR') }}"
       vm_fqdn: "{{ vm_name + '.' + namespace }}"
+    tags:
+      - init_ssh
 
   - name: Gather DNS hostname and zonename
     set_fact:
@@ -23,6 +25,16 @@
       path: "/var/nsd/zones/master/{{ zone }}.zone"
     when: dns_os == 'openbsd-x86_64'
     delegate_to: "{{ dns_host }}"
+
+  - name: Reload DNS zone
+    ansible.builtin.command:
+      argv:
+      - /usr/bin/doas
+      - nsd-control
+      - reload
+      - "{{ zone }}"
+    when: dhcp_os == 'openbsd-x86_64'
+    delegate_to: "{{ dns_host }}"
   
   - name: Insert DNS static host mapping
     vyos.vyos.vyos_config:
diff --git a/ansible/deployment_poc/tasks/configure_dps.yml b/ansible/deployment_poc/tasks/configure_dps.yml
index 1b610b0..3b56eef 100644
--- a/ansible/deployment_poc/tasks/configure_dps.yml
+++ b/ansible/deployment_poc/tasks/configure_dps.yml
@@ -37,9 +37,10 @@
       mode: '0444'
     when: dp_os == 'openbsd-x86_64'
 
-  - name: Generate LUKS passphrase
+  - name: Generate LUKS passphrase #does not quite belong here
     set_fact:
       luks_passphrase: "{{ lookup('password', '/dev/null', length=15, chars=hexdigits, seed=inventory_hostname) }}"
+    no_log: true
 
   - name: Prepare unattended installation
     ansible.builtin.template:
diff --git a/ansible/deployment_poc/tasks/configure_libvirt.yml b/ansible/deployment_poc/tasks/configure_libvirt.yml
index 3b20529..bbcc80e 100644
--- a/ansible/deployment_poc/tasks/configure_libvirt.yml
+++ b/ansible/deployment_poc/tasks/configure_libvirt.yml
@@ -51,7 +51,7 @@
     - name: Create domain template
       ansible.builtin.template:
         src: "../templates/libvirt-template.xml.j2"
-        dest: "../templates/libvirt-{{ inventory_hostname }}.xml"
+        dest: "../templates/generated/libvirt-{{ inventory_hostname }}.xml"
         group: lysergic
         mode: '0660'
 
diff --git a/ansible/deployment_poc/tasks/configure_ssh.yml b/ansible/deployment_poc/tasks/configure_ssh.yml
new file mode 100644
index 0000000..d47b004
--- /dev/null
+++ b/ansible/deployment_poc/tasks/configure_ssh.yml
@@ -0,0 +1,65 @@
+---
+- name: Configure SSH server
+  block:
+    - name: Switch user
+      set_fact:
+        ansible_user_original: "{{ lookup('env', 'USER') }}"
+        ansible_ssh_private_key_file_original: "{{ ansible_ssh_private_key_file }}"
+        ansible_user: install
+        ansible_ssh_private_key_file: "{{ installkey }}"
+    
+    - name: Test 1
+      ansible.builtin.raw: whoami
+      vars:
+        - ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+    
+    - name: Install SSH host certificate
+      ansible.builtin.copy:
+        checksum: "{{ stat_ssh_cert.stat.checksum }}"
+        dest: "/etc/ssh/{{ vm_name }}"
+        group: root
+        local_follow: no
+        mode: 0400
+        owner: root
+        src: "{{ ssh_ca_path }}/host_keys/{{ vm_name }}"
+      become: yes
+      become_method: sudo
+      become_user: root
+      vars:
+        - ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+   
+    - name: Install SSH host key
+      ansible.builtin.copy:
+        checksum: "{{ stat_ssh_spk.stat.checksum }}"
+        dest: "/etc/ssh/{{ vm_name }}-cert.pub"
+        group: root
+        local_follow: no
+        mode: 0444
+        owner: root
+        src: "{{ ssh_ca_path }}/host_keys/{{ vm_name }}-cert.pub"
+      become: yes
+      become_method: sudo
+      become_user: root
+      vars:
+        - ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+ 
+    - name: Install sshd configuration
+      ansible.builtin.script:
+        cmd: "../shell/configure_sshd.sh '{{ ca_pk }}'"
+      become: yes
+      become_method: sudo
+      become_user: root
+      vars:
+        - ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+  
+    - name: Switch user
+      set_fact:
+        ansible_user: "{{ ansible_user_original }}"
+        ansible_ssh_private_key_file: "{{ ansible_ssh_private_key_file_original }}"
+    
+    - name: Test 2
+      ansible.builtin.raw: whoami
+    
+  tags:
+    - init_ssh
+
diff --git a/ansible/deployment_poc/tasks/init_dns.yml b/ansible/deployment_poc/tasks/init_dns.yml
index d3259b9..3e8893f 100644
--- a/ansible/deployment_poc/tasks/init_dns.yml
+++ b/ansible/deployment_poc/tasks/init_dns.yml
@@ -4,4 +4,6 @@
   vars:
     dns_ip: "{{ item }}"
   with_items: "{{ dns_servers }}"
+  tags:
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/init_dps.yml b/ansible/deployment_poc/tasks/init_dps.yml
index 43742b6..8cd2b5e 100644
--- a/ansible/deployment_poc/tasks/init_dps.yml
+++ b/ansible/deployment_poc/tasks/init_dps.yml
@@ -6,4 +6,5 @@
   with_items: "{{ deployment_servers }}"
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/init_ssh.yml b/ansible/deployment_poc/tasks/init_ssh.yml
new file mode 100644
index 0000000..386c517
--- /dev/null
+++ b/ansible/deployment_poc/tasks/init_ssh.yml
@@ -0,0 +1,53 @@
+---
+- name: Initialize SSH host keys
+  block:
+    - name: Generate SSH host keypair
+      ansible.builtin.command:
+        argv:
+        - ssh-keygen
+        - -f
+        - "{{ ssh_ca_path }}/host_keys/{{ vm_name }}"
+        - -t
+        - ed25519
+        - -C
+        - "{{ vm_fqdn }}"
+        - -N
+        - ""
+        creates: "{{ ssh_ca_path }}/host_keys/{{ vm_name }}"
+
+    - name: Evaluate certificate
+      ansible.builtin.stat:
+        path: "{{ ssh_ca_path }}/host_keys/{{ vm_name }}"
+        get_attributes: no
+      register: stat_ssh_cert
+
+#    - name: Sign SSH host key
+#      ansible.builtin.command:
+#        argv:
+#        - ssh-keygen
+#        - -s
+#        - "{{ ssh_ca_path }}/{{ tenant }}"
+#        - -I
+#        - "{{ ssh_ca_prefix }} - {{ vm_fqdn }}"
+#        - -hn
+#        - "{{ vm_fqdn }}"
+#        - "{{ ssh_ca_path }}/host_keys/{{ vm_name }}.pub"
+#        creates: "{{ ssh_ca_path }}/host_keys/{{ vm_name }}-cert.pub"
+
+    - name: Sign SSH host key
+      ansible.builtin.expect:
+        command: ssh-keygen -s "{{ ssh_ca_path }}/{{ tenant }}" -I "{{ ssh_ca_prefix }} - {{ vm_fqdn }}" -hn "{{ vm_fqdn }}" "{{ ssh_ca_path }}/host_keys/{{ vm_name }}.pub"
+        responses:
+          Enter passphrase: "{{ ca_pp }}"
+        timeout: 3
+        creates: "{{ ssh_ca_path }}/host_keys/{{ vm_name }}-cert.pub"
+
+    - name: Evaluate public key
+      ansible.builtin.stat:
+        path: "{{ ssh_ca_path }}/host_keys/{{ vm_name }}-cert.pub"
+        get_attributes: no
+      register: stat_ssh_spk
+
+  delegate_to: localhost
+  tags:
+    - init_ssh
diff --git a/ansible/deployment_poc/tasks/init_vm_console.yml b/ansible/deployment_poc/tasks/init_vm_console.yml
index 1007c90..a74fde6 100644
--- a/ansible/deployment_poc/tasks/init_vm_console.yml
+++ b/ansible/deployment_poc/tasks/init_vm_console.yml
@@ -35,5 +35,7 @@
           - "{{ vm_name }}"
 
   delegate_to: localhost
+  tags:
+    - init_ssh
 
 
diff --git a/ansible/deployment_poc/tasks/netbox_evaluate_cluster.yml b/ansible/deployment_poc/tasks/netbox_evaluate_cluster.yml
index f53eef1..e811291 100644
--- a/ansible/deployment_poc/tasks/netbox_evaluate_cluster.yml
+++ b/ansible/deployment_poc/tasks/netbox_evaluate_cluster.yml
@@ -28,17 +28,23 @@
       when: host_status != 'active'
 
     - name: Evaluate cluster host configuration
-      set_fact:
-        storage: "{{ host_choice.config_context.storage[0] }}"
-        deployment_servers: "{{ host_choice.config_context.deployment_servers }}"
-        dhcp_servers: "{{ host_choice.config_context.dhcp_servers }}"
-        dns_servers: "{{ host_choice.config_context.dns_servers }}"
-        namespace: "{{ host_choice.config_context.namespace }}"
-        gateway: "{{ host_choice.config_context.gateway }}"
+      block:
+        - name: Cluster derived variables 1/2
+          set_fact:
+            storage: "{{ host_choice.config_context.storage[0] }}"
+            deployment_servers: "{{ host_choice.config_context.deployment_servers }}"
+            dhcp_servers: "{{ host_choice.config_context.dhcp_servers }}"
+            dns_servers: "{{ host_choice.config_context.dns_servers }}"
+            namespace: "{{ host_choice.config_context.namespace }}"
+            gateway: "{{ host_choice.config_context.gateway }}"
+        - name: Cluster derived variables 2/2
+          set_fact:
+            namespace_short: "{{ namespace.split('.')[0] }}"
       when: host_status == 'active'
 
   tags:
     - init_dp
+    - init_ssh
 
   rescue:
     - name: Check retry counter
diff --git a/ansible/deployment_poc/tasks/netbox_evaluate_ip.yml b/ansible/deployment_poc/tasks/netbox_evaluate_ip.yml
index fd0399e..47ce9dc 100644
--- a/ansible/deployment_poc/tasks/netbox_evaluate_ip.yml
+++ b/ansible/deployment_poc/tasks/netbox_evaluate_ip.yml
@@ -6,6 +6,9 @@
     ip_address_type: "existing"
     ipid: "{{ nb_ip_1.json.results[0].id }}"
   when: "nb_ip_1.status|int == 200 and nb_ip_1.json.count|int != 0 and (nb_ip_1.json.results[0].status is defined and nb_ip_1.json.results[0].status.value == 'active')"
+  tags:
+    - init_dp
+    - init_ssh
 
 - name: Define new IP address
   set_fact:
@@ -15,3 +18,4 @@
   when: "nb_ip_2.status is defined and nb_ip_2.status|int == 200"
   tags:
     - init_dp
+    - init_ssh
diff --git a/ansible/deployment_poc/tasks/netbox_evaluate_prefix.yml b/ansible/deployment_poc/tasks/netbox_evaluate_prefix.yml
index e07aed9..6437d93 100644
--- a/ansible/deployment_poc/tasks/netbox_evaluate_prefix.yml
+++ b/ansible/deployment_poc/tasks/netbox_evaluate_prefix.yml
@@ -5,4 +5,5 @@
     prefix_display: "{{ nb_prefix.json.results[0].display }}" 
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/netbox_evaluate_site.yml b/ansible/deployment_poc/tasks/netbox_evaluate_site.yml
index d09d2cd..2e69e99 100644
--- a/ansible/deployment_poc/tasks/netbox_evaluate_site.yml
+++ b/ansible/deployment_poc/tasks/netbox_evaluate_site.yml
@@ -4,4 +4,5 @@
     site_id: "{{ nb_site.json.results[0].id }}"
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/netbox_evaluate_vm.yml b/ansible/deployment_poc/tasks/netbox_evaluate_vm.yml
index c320bce..f0f584c 100644
--- a/ansible/deployment_poc/tasks/netbox_evaluate_vm.yml
+++ b/ansible/deployment_poc/tasks/netbox_evaluate_vm.yml
@@ -12,6 +12,7 @@
 #                disk: "{{ nb_vm.json.results[0].disk }}"
   tags:
     - init_dp
+    - init_ssh
     
 - name: Pick metadata
   set_fact:
@@ -24,4 +25,5 @@
 #                #tags: "{{ nb_vm.json.results[0].tags | sum(start=[]) | map(attribute='slug') }}"
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/netbox_query_cluster.yml b/ansible/deployment_poc/tasks/netbox_query_cluster.yml
index a5b6fe0..61fbc16 100644
--- a/ansible/deployment_poc/tasks/netbox_query_cluster.yml
+++ b/ansible/deployment_poc/tasks/netbox_query_cluster.yml
@@ -13,3 +13,4 @@
   delegate_to: localhost
   tags:
     - init_dp
+    - init_ssh
diff --git a/ansible/deployment_poc/tasks/netbox_query_ip.yml b/ansible/deployment_poc/tasks/netbox_query_ip.yml
index a4cea59..f807e4f 100644
--- a/ansible/deployment_poc/tasks/netbox_query_ip.yml
+++ b/ansible/deployment_poc/tasks/netbox_query_ip.yml
@@ -11,6 +11,9 @@
       Authorization: "Token {{ token }}"
   register: nb_ip_1
   delegate_to: localhost
+  tags:
+    - init_dp
+    - init_ssh
 
 - name: Query available address
   ansible.builtin.uri:
@@ -27,4 +30,5 @@
   when: "nb_ip_1.json.count|int == 0 or (nb_ip_1.json.results[0].status is defined and nb_ip_1.json.results[0].status.value != 'active')"
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/netbox_query_prefix.yml b/ansible/deployment_poc/tasks/netbox_query_prefix.yml
index b039d7d..6a99d67 100644
--- a/ansible/deployment_poc/tasks/netbox_query_prefix.yml
+++ b/ansible/deployment_poc/tasks/netbox_query_prefix.yml
@@ -13,4 +13,5 @@
   delegate_to: localhost
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/netbox_query_site.yml b/ansible/deployment_poc/tasks/netbox_query_site.yml
index 65ec180..29956b7 100644
--- a/ansible/deployment_poc/tasks/netbox_query_site.yml
+++ b/ansible/deployment_poc/tasks/netbox_query_site.yml
@@ -13,4 +13,5 @@
   delegate_to: localhost
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/netbox_query_vm.yml b/ansible/deployment_poc/tasks/netbox_query_vm.yml
index bdf6acb..e7702ba 100644
--- a/ansible/deployment_poc/tasks/netbox_query_vm.yml
+++ b/ansible/deployment_poc/tasks/netbox_query_vm.yml
@@ -14,4 +14,5 @@
   delegate_to: localhost
   tags:
     - init_dp
+    - init_ssh
 
diff --git a/ansible/deployment_poc/tasks/wait.yml b/ansible/deployment_poc/tasks/wait.yml
index 3f35e55..7d516ce 100644
--- a/ansible/deployment_poc/tasks/wait.yml
+++ b/ansible/deployment_poc/tasks/wait.yml
@@ -1,10 +1,14 @@
 ---
 - name: Wait for guest to become alive
   wait_for:
-    delay: 240
+    #delay: 240
     connect_timeout: 3
     sleep: 15
     port: 22
-    host: '{{ vm_fqdn }}'
+    host: '{{ ip_address }}'
     search_regex: OpenSSH
-  connection: local
+    timeout: 900
+  #connection: local
+  delegate_to: localhost
+  tags:
+    - init_ssh