Implement FreeIPA server and enroll the pre-existing servers to it

ansible/configure_dns.yml

@@ -0,0 +1,24 @@
+---
+- name: Point VM DNS to central FreeIPA server
+  hosts: control, web, media
+  become: true
+
+  tasks:
+    - name: Get current DNS settings
+      ansible.builtin.command:
+        cmd: nmcli -g ipv4.dns connection show "cloud-init ens3"
+      register: current_dns
+      changed_when: false
+
+    - name: Set DNS servers to FreeIPA
+      ansible.builtin.command:
+        cmd: nmcli con mod "cloud-init ens3" ipv4.dns "172.30.1.100 1.1.1.1"
+      when: (current_dns.stdout | trim) != "172.30.1.100,1.1.1.1"
+      changed_when: true
+      notify: Restart network connection
+
+  handlers:
+    - name: Restart network connection
+      ansible.builtin.command:
+        cmd: nmcli con up "cloud-init ens3"
+      changed_when: false

ansible/deploy_ipa.yml

@@ -0,0 +1,66 @@
+---
+- name: Deploy Central FreeIPA Server
+  hosts: ipa
+  become: true
+
+  vars_files:
+    - vault.yml
+
+  tasks:
+    - name: Set fully qualified domain name
+      ansible.builtin.hostname:
+        name: ipa.shooey.local
+
+    - name: Ensure local FQDN resolves in /etc/hosts
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        line: "172.30.1.100 ipa.shooey.local ipa"
+        state: present
+
+    - name: Install FreeIPA server and firewall dependencies
+      ansible.builtin.dnf:
+        name:
+          - firewalld
+          - python3-firewall
+          - freeipa-server
+          - freeipa-server-dns
+          - bind-dyndb-ldap
+        state: present
+
+    - name: Ensure firewalld is running and enabled
+      ansible.builtin.systemd:
+        name: firewalld
+        state: started
+        enabled: true
+
+    - name: Allow FreeIPA services in firewalld
+      ansible.posix.firewalld:
+        service: "{{ item }}"
+        permanent: true
+        immediate: true
+        state: enabled
+      loop:
+        - freeipa-ldap
+        - freeipa-ldaps
+        - dns
+        - kerberos
+        - kpasswd
+
+    - name: Check if FreeIPA is already installed
+      ansible.builtin.stat:
+        path: /etc/ipa/default.conf
+      register: ipa_installed
+
+    - name: Run FreeIPA unattended installer
+      ansible.builtin.command:
+        cmd: >
+          ipa-server-install
+          --unattended
+          --realm=SHOOEY.LOCAL
+          --ds-password="{{ vault_ipa_ds_password }}"
+          --admin-password="{{ vault_ipa_admin_password }}"
+          --setup-dns
+          --forwarder=1.1.1.1
+          --forwarder=8.8.8.8
+          --auto-reverse
+      when: not ipa_installed.stat.exists

ansible/enroll_clients.yml

@@ -0,0 +1,32 @@
+---
+- name: Enroll client VMs into FreeIPA realm
+  hosts: control, web, media
+  become: true
+
+  vars_files:
+    - vault.yml
+
+  tasks:
+    - name: Install FreeIPA client packages
+      ansible.builtin.dnf:
+        name: freeipa-client
+        state: present
+
+    - name: Check if already enrolled in FreeIPA
+      ansible.builtin.stat:
+        path: /etc/ipa/default.conf
+      register: ipa_client_config
+
+    - name: Run FreeIPA client enrollment
+      ansible.builtin.command:
+        cmd: >
+          ipa-client-install
+          --unattended
+          --domain=shooey.local
+          --realm=SHOOEY.LOCAL
+          --server=ipa.shooey.local
+          --principal=admin
+          --password="{{ vault_ipa_admin_password }}"
+          --mkhomedir
+      when: not ipa_client_config.stat.exists
+      changed_when: true

ansible/inventory.ini

@@ -7,6 +7,9 @@ web-portfolio   ansible_host=172.30.1.201
 [media]
 media-stream    ansible_host=172.30.1.202
 
+[ipa]
+ipa-dns         ansible_host=172.30.1.100
+
 [all:vars]
 ansible_user=ansible
 ansible_ssh_private_key_file=~/.ssh/id_ed25519

terraform/main.tf

@@ -16,22 +16,10 @@ locals {
   ssh_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHwJzj/dCMOC+zJviqO32+/22kABZBdwC+NvyM+7+Vz sho@nobara"
 
   vms = {
-        "ansible-control" = {
+    "freeipa" = {
-            vcpu    = 2
-            memory  = 2048
-            ip      = "172.30.1.200"
-        }
-
-        "web-portfolio" = {
-            vcpu    = 2
-            memory  = 2048
-            ip      = "172.30.1.201"
-        }
-
-        "media-stream" = {
       vcpu   = 2
       memory = 4096
-            ip      = "172.30.1.202"
+      ip     = "172.30.1.100"
     }
   }
 }

terraform/network_config.cfg

@@ -6,4 +6,4 @@ ethernets:
             - ${ip_address}/24
         gateway4: 172.30.1.254
         nameservers:
-            addresses: [8.8.8.8, 1.1.1.1]
+            addresses: [172.30.1.100, 1.1.1.1]