provision-infra-databases.yml

---
- name: "INITIAL SETUP"
  hosts: databases.infra.netsoc.co
  become: yes
  roles:
    - ansible-requirements
    - utf8-locale
    - docker
  tasks:
    - name: "Make /netsoc only readable by root"
      file:
        path: "/netsoc"
        owner: root
        group: root
        mode: '1770'
  tags:
    - initial

- name: "DATABASES - MySQL/PG"
  hosts: databases.infra.netsoc.co
  become: yes
  tasks:    
    - name: MYSQL/PG/PROM - Ensure directories exist
      file:
        path: "/netsoc/{{ item }}"
        owner: root
        group: root
        mode: '0755'
        state: directory
      with_items:
        - mysql
        - pg

    - name: PG - Install psycopg2 (needed for ansible pg driver)
      apt:
        name: python3-psycopg2
        state: present

    - name: MYSQL/PG - Remember Compose definition
      set_fact:
        definition: 
          version: "3.5"
          services:
            mysql:
              hostname: "mysql.databases.infra.netsoc.co"
              command: --default-authentication-plugin=mysql_native_password
              image: mysql:8.0
              restart: always
              environment:
                MYSQL_ROOT_PASSWORD: "{{ mysql.infra.root_password }}"
              volumes:
                - "/netsoc/mysql:/var/lib/mysql"
              ports:
                - "3306:3306"
            pg:
              hostname: "pg.databases.netsoc.co"
              image: postgres:12.3
              restart: always
              environment:
                POSTGRES_PASSWORD: "{{ postgres.infra.postgres_password }}"
              volumes:
                - "/netsoc/pg:/var/lib/postgresql/data"
              ports:
                - "5432:5432"

    - name: MYSQL/PG - Setup services
      docker_compose:
        project_name: databases
        recreate: smart
        remove_orphans: yes
        state: present
        definition: "{{ definition }}"
  vars_files:
    - "vars/network.yml"
    - "vars/secrets_mapping.yml"
    - "vars/secrets.yml"
  tags:
    - provision

- name: "DATABASES - Prometheus"
  hosts: databases.infra.netsoc.co
  become: yes
  tasks:    
    - name: PROM - Ensure directories exist
      file:
        path: "/netsoc/{{ item }}"
        owner: root
        group: root
        mode: '0755'
        state: directory
      with_items:
        - prometheus
        - blackbox_exporter
        - pve
  roles:
    - role: prometheus-server
      vars:
        prometheus_dir: "/netsoc/prometheus"
        blackbox_exporter_dir: "/netsoc/blackbox_exporter"
        pve_dir: "/netsoc/pve"
  vars_files:
    - "vars/network.yml"
    - "vars/secrets_mapping.yml"
    - "vars/secrets.yml"
  tags:
    - provision
    - prometheus

- name: "DATABASES - FreeIPA/Keycloak"
  hosts: databases.infra.netsoc.co
  become: yes
  tasks:
    - name: IPA - Ensure IPA directory exists
      file:
        path: "/netsoc/ipa"
        owner: root
        group: root
        # Needs to be 775 as this folder is accessed internally by a dirsrv user
        # https://github.com/freeipa/freeipa-container/issues/281
        mode: '0755'
        state: directory

    - name: KEYCLOAK - Ensure Keycloak directory exists
      file:
        path: "/netsoc/keycloak"
        owner: root
        group: root
        # Uses UIDs interally too
        mode: '0777'
        state: directory

    - name: KEYCLOAK - Ensure Keycloak directories exists
      file:
        path: "/netsoc/keycloak/{{ item }}"
        owner: root
        group: root
        # Uses UIDs interally too
        mode: '0777'
        state: directory
      with_items:
        - realm

    - name: KEYCLOAK - Ensure realm file
      copy:
        src: "./vars/keycloak-realm-exported.json"
        dest: "/netsoc/keycloak/realm/realm.json"
        mode: 0755

    - name: IPA/KEYCLOAK - Remember Compose definition
      set_fact:
        definition: 
          version: "3.5"
          services:
            keycloak:
              image: uccnetsoc/keycloak:9.0.3-themed
              environment:
                DB_VENDOR: h2
                KEYCLOAK_USER: "{{ keycloak.username }}"
                KEYCLOAK_PASSWORD: "{{ keycloak.password }}"
                KEYCLOAK_IMPORT: "/tmp/realm/realm.json"
              restart: always
              ports:
                - "8443:8443"
              volumes:
                - "/netsoc/keycloak/realm:/tmp/realm/"
                - "/etc/localtime:/etc/localtime:ro"
            ipa:
              image: freeipa/freeipa-server:centos-8-4.8.4
              command: >
                --unattended
                --realm={{ ipa.realm }}
                --domain={{ ipa.domain }}
                --ds-password={{ ipa.ds_password }}
                --admin-password={{ ipa.admin_password }}
                --setup-dns
                --forwarder=1.1.1.1
                --forward-policy=only
                --ssh-trust-dns
              hostname: "{{ ipa.server }}"
              dns: 127.0.0.1
              environment:
                IPA_SERVER_HOSTNAME: "{{ ipa.server }}"
                IPA_SERVER_IP: "{{ ansible_default_ipv4.address }}"
              ports:
                - "80:80"      # http
                - "443:443"    # https
                - "389:389"    # ldap
                - "636:636"    # ldaps
                - "88:88"      # kerberos
                - "464:464"    # kpasswd 
                - "749:749"    # kpasswd
                - "123:123"    # ntp
                - "{{ ansible_default_ipv4.address }}:53:53/tcp"  # dns
                - "{{ ansible_default_ipv4.address }}:53:53/udp"
              volumes:
                - "/sys/fs/cgroup:/sys/fs/cgroup:ro"
                - "/etc/machine-id:/etc/machine-id"
                - "/netsoc/ipa:/data:Z"
              restart: always
              tmpfs:
                - "/run"
                - "/tmp"
              sysctls:
                # Fixes:
                # DEBUG The ipa-server-install command failed, exception: 
                # RuntimeError: IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned.
                # Add ::1 address resolution to "lo" interface. You might need to enable IPv6 on the interface "lo" in sysctl.conf.
                net.ipv6.conf.lo.disable_ipv6: 0

    - name: IPA/KEYCLOAK - Setup services
      docker_compose:
        project_name: auth
        recreate: always
        pull: yes
        remove_orphans: yes
        state: present
        definition: "{{ definition }}"

    - name: IPA - Wait for IPA install to finish (8-12 minutes, check /netsoc/ipa/var/log/ipa-server-configure-first.log if time out)
      wait_for:
        path: "/netsoc/ipa/var/log/ipaserver-install.log"
        search_regex: "The ipa-server-install command"
        timeout: 1200 # 20 minutes

    - name: IPA - Check install status
      become: yes
      shell: "grep -i 'The ipa-server-install command was successful' /netsoc/ipa/var/log/ipaserver-install.log"

    - name: IPA - Ensure HTTP redirect disabler (disables some of their apache config and lets us reverse proxy IPA WebUI)
      become: yes
      copy:
        content: |
          # VERSION 6 - DO NOT REMOVE THIS LINE

          # ORIGINAL
          # RewriteEngine on

          # # By default forward all requests to /ipa. If you don't want IPA
          # # to be the default on your web server comment this line out.
          # RewriteRule ^/$ https://ipa.infra.netsoc.co/ipa/ui [L,NC,R=301]

          # # Redirect to the fully-qualified hostname. Not redirecting to secure
          # # port so configuration files can be retrieved without requiring SSL.
          # RewriteCond %{HTTP_HOST}    !^ipa.vm.netsoc.co$ [NC]
          # RewriteRule ^/ipa/(.*)      http://ipa.infra.netsoc.co/ipa/$1 [L,R=301]

          # # Redirect to the secure port if not displaying an error or retrieving
          # # configuration.
          # RewriteCond %{SERVER_PORT}  !^443$
          # RewriteCond %{REQUEST_URI}  !^/ipa/(errors|config|crl)
          # RewriteCond %{REQUEST_URI}  !^/ipa/[^\?]+(\.js|\.css|\.png|\.gif|\.ico|\.woff|\.svg|\.ttf|\.eot)$
          # RewriteRule ^/ipa/(.*)      https://ipa.infra.netsoc.co/ipa/$1 [L,R=301,NC]

          # # Rewrite for plugin index, make it like it's a static file
          # RewriteRule ^/ipa/ui/js/freeipa/plugins.js$    /ipa/wsgi/plugins.py [PT]

          # MODIFIED
          RewriteEngine on

          # By default forward all requests to /ipa. If you don't want IPA
          # to be the default on your web server comment this line out.
          RewriteRule ^/$ /ipa/ui [L,NC,R=301]

          # Redirect to the fully-qualified hostname. Not redirecting to secure
          # port so configuration files can be retrieved without requiring SSL.
          #RewriteCond %{HTTP_HOST}    !^ipa.vm.netsoc.co$ [NC]
          #RewriteRule ^/ipa/(.*)      http://ipa.infra.netsoc.co/ipa/$1 [L,R=301]

          # Redirect to the secure port if not displaying an error or retrieving
          # configuration.
          #RewriteCond %{SERVER_PORT}  !^443$
          #RewriteCond %{REQUEST_URI}  !^/ipa/(errors|config|crl)
          #RewriteCond %{REQUEST_URI}  !^/ipa/[^\?]+(\.js|\.css|\.png|\.gif|\.ico|\.woff|\.svg|\.ttf|\.eot)$
          #RewriteRule ^/ipa/(.*)      https://ipa.infra.netsoc.co/ipa/$1 [L,R=301,NC]

          # Rewrite for plugin index, make it like it's a static file
          RewriteRule ^/ipa/ui/js/freeipa/plugins.js$    /ipa/wsgi/plugins.py [PT]
        dest: "/netsoc/ipa/etc/httpd/conf.d/ipa-rewrite.conf"

    - set_fact:
        recursive_dns_trusted_network:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16

    - name: IPA - Insert trusted network ACLs for DNS
      blockinfile:
        path: "/netsoc/ipa/etc/named.conf"
        insertbefore: "BOF"
        marker: "# Trusted Network For Recursive DNS Queries - {mark}"
        block: |
          acl "trusted_network" {
            {% for trusted in recursive_dns_trusted_network %}
              {{ trusted }};
            {% endfor %}
          };

    - name: IPA - Modify IPA /etc/named to support queries from intralan
      blockinfile:
        path: "/netsoc/ipa/etc/named.conf"
        insertafter: "options"
        marker: "# Enable Trusted Network For Recursive DNS Queries - {mark}"
        block: |
          allow-recursion { trusted_network; };
          allow-query-cache { trusted_network; };

    - name: IPA - Restart
      docker_compose:
        project_name: auth
        restarted: yes
        state: present
        services:
          - ipa
        definition: "{{ definition }}"
  vars_files:
    - "vars/network.yml"
    - "vars/secrets_mapping.yml"
    - "vars/secrets.yml"
  tags:
    - provision
    - freeipa
    - keycloak