ansible-collections/middleware_automation.keycloak
1
0
Fork 0
mirror of https://github.com/ansible-middleware/keycloak.git synced 2025-04-06 10:50:31 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Copy the TLS private key from memory

Browse source 
This change should avoid storing plain private keys on disk due to
security risks. It also makes it easier to encrypt the data with SOPS.
This commit is contained in:
Footur 2024-05-05 11:58:19 +00:00
parent 7141e1c9b2
commit 320a5f0d9a
5 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
molecule/quarkus/converge.yml
View file

@ -10,7 +10,7 @@
keycloak_quarkus_log_level: debug keycloak_quarkus_log_level: debug
keycloak_quarkus_https_key_file_enabled: true keycloak_quarkus_https_key_file_enabled: true
keycloak_quarkus_key_file_copy_enabled: true keycloak_quarkus_key_file_copy_enabled: true
keycloak_quarkus_key_file_src: key.pem keycloak_quarkus_key_content: "{{ lookup('file', 'key.pem') }}"
keycloak_quarkus_cert_file_copy_enabled: true keycloak_quarkus_cert_file_copy_enabled: true
keycloak_quarkus_cert_file_src: cert.pem keycloak_quarkus_cert_file_src: cert.pem
keycloak_quarkus_log_target: /tmp/keycloak keycloak_quarkus_log_target: /tmp/keycloak

2
roles/keycloak_quarkus/README.md
View file

@ -45,7 +45,7 @@ Role Defaults
|`keycloak_quarkus_http_enabled`| Enable listener on HTTP port | `True` | |`keycloak_quarkus_http_enabled`| Enable listener on HTTP port | `True` |
|`keycloak_quarkus_https_key_file_enabled`| Enable listener on HTTPS port | `False` | |`keycloak_quarkus_https_key_file_enabled`| Enable listener on HTTPS port | `False` |
|`keycloak_quarkus_key_file_copy_enabled`| Enable copy of key file to target host | `False` | |`keycloak_quarkus_key_file_copy_enabled`| Enable copy of key file to target host | `False` |
|`keycloak_quarkus_key_file_src`| Set the source file path | `""` | |`keycloak_quarkus_key_content`| Content of the TLS private key. Use `"{{ lookup('file', 'server.key.pem') }}"` to lookup a file. | `""` |
|`keycloak_quarkus_key_file`| The file path to a private key in PEM format | `/etc/pki/tls/private/server.key.pem` | |`keycloak_quarkus_key_file`| The file path to a private key in PEM format | `/etc/pki/tls/private/server.key.pem` |
|`keycloak_quarkus_cert_file_copy_enabled`| Enable copy of cert file to target host | `False`| |`keycloak_quarkus_cert_file_copy_enabled`| Enable copy of cert file to target host | `False`|
|`keycloak_quarkus_cert_file_src`| Set the source file path | `""` | |`keycloak_quarkus_cert_file_src`| Set the source file path | `""` |

2
roles/keycloak_quarkus/defaults/main.yml
View file

@ -48,7 +48,7 @@ keycloak_quarkus_java_opts: "{{ keycloak_quarkus_java_heap_opts + ' ' + keycloak
### TLS/HTTPS configuration ### TLS/HTTPS configuration
keycloak_quarkus_https_key_file_enabled: false keycloak_quarkus_https_key_file_enabled: false
keycloak_quarkus_key_file_copy_enabled: false keycloak_quarkus_key_file_copy_enabled: false
keycloak_quarkus_key_file_src: "" keycloak_quarkus_key_content: ""
keycloak_quarkus_key_file: "/etc/pki/tls/private/server.key.pem" keycloak_quarkus_key_file: "/etc/pki/tls/private/server.key.pem"
keycloak_quarkus_cert_file_copy_enabled: false keycloak_quarkus_cert_file_copy_enabled: false
keycloak_quarkus_cert_file_src: "" keycloak_quarkus_cert_file_src: ""

4
roles/keycloak_quarkus/meta/argument_specs.yml
View file

@ -112,9 +112,9 @@ argument_specs:
default: false default: false
description: "Enable copy of key file to target host" description: "Enable copy of key file to target host"
type: "bool" type: "bool"
keycloak_quarkus_key_file_src: keycloak_quarkus_key_content:
default: "" default: ""
description: "Set the source file path" description: "Content of the TLS private key"
type: "str" type: "str"
keycloak_quarkus_key_file: keycloak_quarkus_key_file:
default: "/etc/pki/tls/private/server.key.pem" default: "/etc/pki/tls/private/server.key.pem"

4
roles/keycloak_quarkus/tasks/install.yml
View file

@ -161,7 +161,7 @@
- name: "Copy private key to target" - name: "Copy private key to target"
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ keycloak_quarkus_key_file_src }}" content: "{{ keycloak_quarkus_key_content }}"
dest: "{{ keycloak_quarkus_key_file }}" dest: "{{ keycloak_quarkus_key_file }}"
owner: "{{ keycloak.service_user }}" owner: "{{ keycloak.service_user }}"
group: "{{ keycloak.service_group }}" group: "{{ keycloak.service_group }}"
@ -170,7 +170,7 @@
when: when:
- keycloak_quarkus_https_key_file_enabled is defined and keycloak_quarkus_https_key_file_enabled - keycloak_quarkus_https_key_file_enabled is defined and keycloak_quarkus_https_key_file_enabled
- keycloak_quarkus_key_file_copy_enabled is defined and keycloak_quarkus_key_file_copy_enabled - keycloak_quarkus_key_file_copy_enabled is defined and keycloak_quarkus_key_file_copy_enabled
- keycloak_quarkus_key_file_src | length > 0 - keycloak_quarkus_key_content | length > 0
- name: "Copy certificate to target" - name: "Copy certificate to target"
ansible.builtin.copy: ansible.builtin.copy: