67 lines
1.7 KiB
YAML
67 lines
1.7 KiB
YAML
---
|
|
- name: Deploy Central FreeIPA Server
|
|
hosts: ipa
|
|
become: true
|
|
|
|
vars_files:
|
|
- vault.yml
|
|
|
|
tasks:
|
|
- name: Set fully qualified domain name
|
|
ansible.builtin.hostname:
|
|
name: ipa.shooey.local
|
|
|
|
- name: Ensure local FQDN resolves in /etc/hosts
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/hosts
|
|
line: "172.30.1.100 ipa.shooey.local ipa"
|
|
state: present
|
|
|
|
- name: Install FreeIPA server and firewall dependencies
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- firewalld
|
|
- python3-firewall
|
|
- freeipa-server
|
|
- freeipa-server-dns
|
|
- bind-dyndb-ldap
|
|
state: present
|
|
|
|
- name: Ensure firewalld is running and enabled
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Allow FreeIPA services in firewalld
|
|
ansible.posix.firewalld:
|
|
service: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
loop:
|
|
- freeipa-ldap
|
|
- freeipa-ldaps
|
|
- dns
|
|
- kerberos
|
|
- kpasswd
|
|
|
|
- name: Check if FreeIPA is already installed
|
|
ansible.builtin.stat:
|
|
path: /etc/ipa/default.conf
|
|
register: ipa_installed
|
|
|
|
- name: Run FreeIPA unattended installer
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
ipa-server-install
|
|
--unattended
|
|
--realm=SHOOEY.LOCAL
|
|
--ds-password="{{ vault_ipa_ds_password }}"
|
|
--admin-password="{{ vault_ipa_admin_password }}"
|
|
--setup-dns
|
|
--forwarder=1.1.1.1
|
|
--forwarder=8.8.8.8
|
|
--auto-reverse
|
|
when: not ipa_installed.stat.exists
|