65 lines
1.6 KiB
YAML
65 lines
1.6 KiB
YAML
---
|
|
- name: Install and Configure FreeIPA Server
|
|
hosts: freeipa.lab.local
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Set hostname to fully-qualified domain name
|
|
become: true
|
|
ansible.builtin.hostname:
|
|
name: "freeipa.{{ domain_name }}"
|
|
|
|
- name: Install FreeIPA Server packages and firewalld
|
|
become: true
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- freeipa-server
|
|
- freeipa-server-dns
|
|
- bind
|
|
- bind-utils
|
|
- firewalld
|
|
- python3-firewall
|
|
state: present
|
|
|
|
- name: Ensure firewalld is started and enabled
|
|
become: true
|
|
ansible.builtin.systemd_service:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Check if FreeIPA is already installed
|
|
ansible.builtin.stat:
|
|
path: /etc/ipa/default.conf
|
|
register: ipa_installed
|
|
|
|
- name: Run FreeIPA unattended installer
|
|
become: true
|
|
ansible.builtin.command: >
|
|
ipa-server-install
|
|
--unattended
|
|
--realm={{ realm_name }}
|
|
--domain={{ domain_name }}
|
|
--ds-password={{ ipa_directory_manager_password }}
|
|
--admin-password={{ ipa_admin_password }}
|
|
--setup-dns
|
|
--forwarder=1.1.1.1
|
|
--no-host-dns
|
|
when: not ipa_installed.stat.exists
|
|
vars:
|
|
ansible_command_timeout: 1200
|
|
changed_when: false
|
|
|
|
- name: Configure firewalld rules for FreeIPA
|
|
become: true
|
|
ansible.posix.firewalld:
|
|
service: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
loop:
|
|
- freeipa-ldaps
|
|
- freeipa-ldap
|
|
- dns
|
|
- kerberos
|