Implement FreeIPA server and enroll the pre-existing servers to it
This commit is contained in:
Isshi0417
parent
26b3d3ba1f
commit
942cd43c2e
24
ansible/configure_dns.yml
Normal file
24
ansible/configure_dns.yml
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
---
|
||||||
|
- name: Point VM DNS to central FreeIPA server
|
||||||
|
hosts: control, web, media
|
||||||
|
become: true
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Get current DNS settings
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: nmcli -g ipv4.dns connection show "cloud-init ens3"
|
||||||
|
register: current_dns
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Set DNS servers to FreeIPA
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: nmcli con mod "cloud-init ens3" ipv4.dns "172.30.1.100 1.1.1.1"
|
||||||
|
when: (current_dns.stdout | trim) != "172.30.1.100,1.1.1.1"
|
||||||
|
changed_when: true
|
||||||
|
notify: Restart network connection
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
- name: Restart network connection
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: nmcli con up "cloud-init ens3"
|
||||||
|
changed_when: false
|
||||||
66
ansible/deploy_ipa.yml
Normal file
66
ansible/deploy_ipa.yml
Normal file
@ -0,0 +1,66 @@
|
|||||||
|
---
|
||||||
|
- name: Deploy Central FreeIPA Server
|
||||||
|
hosts: ipa
|
||||||
|
become: true
|
||||||
|
|
||||||
|
vars_files:
|
||||||
|
- vault.yml
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Set fully qualified domain name
|
||||||
|
ansible.builtin.hostname:
|
||||||
|
name: ipa.shooey.local
|
||||||
|
|
||||||
|
- name: Ensure local FQDN resolves in /etc/hosts
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /etc/hosts
|
||||||
|
line: "172.30.1.100 ipa.shooey.local ipa"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Install FreeIPA server and firewall dependencies
|
||||||
|
ansible.builtin.dnf:
|
||||||
|
name:
|
||||||
|
- firewalld
|
||||||
|
- python3-firewall
|
||||||
|
- freeipa-server
|
||||||
|
- freeipa-server-dns
|
||||||
|
- bind-dyndb-ldap
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Ensure firewalld is running and enabled
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: firewalld
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
- name: Allow FreeIPA services in firewalld
|
||||||
|
ansible.posix.firewalld:
|
||||||
|
service: "{{ item }}"
|
||||||
|
permanent: true
|
||||||
|
immediate: true
|
||||||
|
state: enabled
|
||||||
|
loop:
|
||||||
|
- freeipa-ldap
|
||||||
|
- freeipa-ldaps
|
||||||
|
- dns
|
||||||
|
- kerberos
|
||||||
|
- kpasswd
|
||||||
|
|
||||||
|
- name: Check if FreeIPA is already installed
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: /etc/ipa/default.conf
|
||||||
|
register: ipa_installed
|
||||||
|
|
||||||
|
- name: Run FreeIPA unattended installer
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: >
|
||||||
|
ipa-server-install
|
||||||
|
--unattended
|
||||||
|
--realm=SHOOEY.LOCAL
|
||||||
|
--ds-password="{{ vault_ipa_ds_password }}"
|
||||||
|
--admin-password="{{ vault_ipa_admin_password }}"
|
||||||
|
--setup-dns
|
||||||
|
--forwarder=1.1.1.1
|
||||||
|
--forwarder=8.8.8.8
|
||||||
|
--auto-reverse
|
||||||
|
when: not ipa_installed.stat.exists
|
||||||
32
ansible/enroll_clients.yml
Normal file
32
ansible/enroll_clients.yml
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
---
|
||||||
|
- name: Enroll client VMs into FreeIPA realm
|
||||||
|
hosts: control, web, media
|
||||||
|
become: true
|
||||||
|
|
||||||
|
vars_files:
|
||||||
|
- vault.yml
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Install FreeIPA client packages
|
||||||
|
ansible.builtin.dnf:
|
||||||
|
name: freeipa-client
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Check if already enrolled in FreeIPA
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: /etc/ipa/default.conf
|
||||||
|
register: ipa_client_config
|
||||||
|
|
||||||
|
- name: Run FreeIPA client enrollment
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: >
|
||||||
|
ipa-client-install
|
||||||
|
--unattended
|
||||||
|
--domain=shooey.local
|
||||||
|
--realm=SHOOEY.LOCAL
|
||||||
|
--server=ipa.shooey.local
|
||||||
|
--principal=admin
|
||||||
|
--password="{{ vault_ipa_admin_password }}"
|
||||||
|
--mkhomedir
|
||||||
|
when: not ipa_client_config.stat.exists
|
||||||
|
changed_when: true
|
||||||
@ -7,6 +7,9 @@ web-portfolio ansible_host=172.30.1.201
|
|||||||
[media]
|
[media]
|
||||||
media-stream ansible_host=172.30.1.202
|
media-stream ansible_host=172.30.1.202
|
||||||
|
|
||||||
|
[ipa]
|
||||||
|
ipa-dns ansible_host=172.30.1.100
|
||||||
|
|
||||||
[all:vars]
|
[all:vars]
|
||||||
ansible_user=ansible
|
ansible_user=ansible
|
||||||
ansible_ssh_private_key_file=~/.ssh/id_ed25519
|
ansible_ssh_private_key_file=~/.ssh/id_ed25519
|
||||||
@ -1,103 +1,91 @@
|
|||||||
terraform {
|
terraform {
|
||||||
required_version = ">= 1.0"
|
required_version = ">= 1.0"
|
||||||
required_providers {
|
required_providers {
|
||||||
libvirt = {
|
libvirt = {
|
||||||
source = "dmacvicar/libvirt"
|
source = "dmacvicar/libvirt"
|
||||||
version = "0.7.6"
|
version = "0.7.6"
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
provider "libvirt" {
|
provider "libvirt" {
|
||||||
uri = "qemu+ssh://sho@hypervisor.lab.local/system"
|
uri = "qemu+ssh://sho@hypervisor.lab.local/system"
|
||||||
}
|
}
|
||||||
|
|
||||||
locals {
|
locals {
|
||||||
ssh_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHwJzj/dCMOC+zJviqO32+/22kABZBdwC+NvyM+7+Vz sho@nobara"
|
ssh_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHwJzj/dCMOC+zJviqO32+/22kABZBdwC+NvyM+7+Vz sho@nobara"
|
||||||
|
|
||||||
vms = {
|
vms = {
|
||||||
"ansible-control" = {
|
"freeipa" = {
|
||||||
vcpu = 2
|
vcpu = 2
|
||||||
memory = 2048
|
memory = 4096
|
||||||
ip = "172.30.1.200"
|
ip = "172.30.1.100"
|
||||||
}
|
|
||||||
|
|
||||||
"web-portfolio" = {
|
|
||||||
vcpu = 2
|
|
||||||
memory = 2048
|
|
||||||
ip = "172.30.1.201"
|
|
||||||
}
|
|
||||||
|
|
||||||
"media-stream" = {
|
|
||||||
vcpu = 2
|
|
||||||
memory = 4096
|
|
||||||
ip = "172.30.1.202"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "libvirt_volume" "vm_disk" {
|
resource "libvirt_volume" "vm_disk" {
|
||||||
for_each = local.vms
|
for_each = local.vms
|
||||||
name = "${each.key}.qcow"
|
name = "${each.key}.qcow"
|
||||||
pool = "images"
|
pool = "images"
|
||||||
base_volume_name = "rhel-10-guest.qcow2"
|
base_volume_name = "rhel-10-guest.qcow2"
|
||||||
size = 21474836480
|
size = 21474836480
|
||||||
format = "qcow2"
|
format = "qcow2"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "libvirt_cloudinit_disk" "commoninit" {
|
resource "libvirt_cloudinit_disk" "commoninit" {
|
||||||
for_each = local.vms
|
for_each = local.vms
|
||||||
name = "commoninit-${each.key}.raw"
|
name = "commoninit-${each.key}.raw"
|
||||||
pool = "images"
|
pool = "images"
|
||||||
user_data = templatefile("${path.module}/cloud_init.cfg", {
|
user_data = templatefile("${path.module}/cloud_init.cfg", {
|
||||||
hostname = each.key
|
hostname = each.key
|
||||||
ssh_key = local.ssh_key
|
ssh_key = local.ssh_key
|
||||||
})
|
})
|
||||||
network_config = templatefile("${path.module}/network_config.cfg", {
|
network_config = templatefile("${path.module}/network_config.cfg", {
|
||||||
ip_address = each.value.ip
|
ip_address = each.value.ip
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "libvirt_domain" "rhel_vm" {
|
resource "libvirt_domain" "rhel_vm" {
|
||||||
for_each = local.vms
|
for_each = local.vms
|
||||||
name = each.key
|
name = each.key
|
||||||
memory = each.value.memory
|
memory = each.value.memory
|
||||||
vcpu = each.value.vcpu
|
vcpu = each.value.vcpu
|
||||||
|
|
||||||
cpu {
|
cpu {
|
||||||
mode = "host-passthrough"
|
mode = "host-passthrough"
|
||||||
}
|
}
|
||||||
|
|
||||||
firmware = "/usr/share/edk2/ovmf/OVMF_CODE.fd"
|
firmware = "/usr/share/edk2/ovmf/OVMF_CODE.fd"
|
||||||
nvram {
|
nvram {
|
||||||
file = "/var/lib/libvirt/qemu/nvram/${each.key}_VARS.fd"
|
file = "/var/lib/libvirt/qemu/nvram/${each.key}_VARS.fd"
|
||||||
template = "/usr/share/edk2/ovmf/OVMF_VARS.fd"
|
template = "/usr/share/edk2/ovmf/OVMF_VARS.fd"
|
||||||
}
|
}
|
||||||
|
|
||||||
qemu_agent = false
|
qemu_agent = false
|
||||||
|
|
||||||
disk {
|
disk {
|
||||||
volume_id = libvirt_volume.vm_disk[each.key].id
|
volume_id = libvirt_volume.vm_disk[each.key].id
|
||||||
}
|
}
|
||||||
|
|
||||||
disk {
|
disk {
|
||||||
file = "/var/lib/libvirt/images/commoninit-${each.key}.raw"
|
file = "/var/lib/libvirt/images/commoninit-${each.key}.raw"
|
||||||
scsi = true
|
scsi = true
|
||||||
}
|
}
|
||||||
|
|
||||||
network_interface {
|
network_interface {
|
||||||
bridge = "br0"
|
bridge = "br0"
|
||||||
}
|
}
|
||||||
|
|
||||||
console {
|
console {
|
||||||
type = "pty"
|
type = "pty"
|
||||||
target_port = "0"
|
target_port = "0"
|
||||||
target_type = "serial"
|
target_type = "serial"
|
||||||
}
|
}
|
||||||
|
|
||||||
graphics {
|
graphics {
|
||||||
type = "vnc"
|
type = "vnc"
|
||||||
listen_type = "address"
|
listen_type = "address"
|
||||||
autoport = true
|
autoport = true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@ -6,4 +6,4 @@ ethernets:
|
|||||||
- ${ip_address}/24
|
- ${ip_address}/24
|
||||||
gateway4: 172.30.1.254
|
gateway4: 172.30.1.254
|
||||||
nameservers:
|
nameservers:
|
||||||
addresses: [8.8.8.8, 1.1.1.1]
|
addresses: [172.30.1.100, 1.1.1.1]
|
||||||
Loading…
Reference in New Issue
Block a user