From e13a935f80349bf79b781a064641597787ae4b71 Mon Sep 17 00:00:00 2001 From: Ryan Cavicchioni Date: Sun, 1 Dec 2019 20:40:12 -0600 Subject: [PATCH] Add autossh role --- roles/autossh/defaults/main.yaml | 17 +++++ roles/autossh/handlers/main.yaml | 20 ++++++ roles/autossh/tasks/keys.yaml | 28 ++++++++ roles/autossh/tasks/main.yaml | 80 ++++++++++++++++++++++ roles/autossh/templates/autossh.j2 | 8 +++ roles/autossh/templates/autossh.service.j2 | 19 +++++ 6 files changed, 172 insertions(+) create mode 100644 roles/autossh/defaults/main.yaml create mode 100644 roles/autossh/handlers/main.yaml create mode 100644 roles/autossh/tasks/keys.yaml create mode 100644 roles/autossh/tasks/main.yaml create mode 100644 roles/autossh/templates/autossh.j2 create mode 100644 roles/autossh/templates/autossh.service.j2 diff --git a/roles/autossh/defaults/main.yaml b/roles/autossh/defaults/main.yaml new file mode 100644 index 0000000..e319a85 --- /dev/null +++ b/roles/autossh/defaults/main.yaml @@ -0,0 +1,17 @@ +--- +autossh_package_name: autossh +autossh_package_state: present + +autossh_service_name: autossh@.service +autossh_systemd_unit_path: /etc/systemd/system/autossh@.service + +autossh_etc_path: /etc/autossh +autossh_run_path: /run/autossh + +autossh_user: autossh +autossh_group: autossh +autossh_user_state: present +autossh_user_comment: AutoSSH +autossh_user_home: "/home/{{ autossh_user }}" +autossh_user_password: "!" +autossh_user_shell: /usr/sbin/nologin diff --git a/roles/autossh/handlers/main.yaml b/roles/autossh/handlers/main.yaml new file mode 100644 index 0000000..e7a5e8a --- /dev/null +++ b/roles/autossh/handlers/main.yaml @@ -0,0 +1,20 @@ +--- +- name: autossh daemon-reload + systemd: + daemon_reload: yes + +- name: reload autossh + service: + name: "{{ autossh_service_name }}" + state: reloaded + +- name: restart autossh + service: + name: "{{ autossh_service_name }}" + state: restarted + +- name: reload autossh instances + service: + name: "autossh@{{ item.name }}.service" + state: restarted + loop: "{{ autossh_config | default([]) }}" diff --git a/roles/autossh/tasks/keys.yaml b/roles/autossh/tasks/keys.yaml new file mode 100644 index 0000000..9039696 --- /dev/null +++ b/roles/autossh/tasks/keys.yaml @@ -0,0 +1,28 @@ +--- +- set_fact: + key_path: "{{ autossh_user_home }}/.ssh/{{ item }}" + +- name: "install private key ({{ item }})" + copy: + dest: "{{ autossh_user_home }}/.ssh/{{ item }}" + content: "{{ lookup('vars', 'autossh_private_key_' + item) }}" + owner: "{{ autossh_user }}" + group: "{{ autossh_group }}" + mode: 0600 + when: lookup('vars', 'autossh_private_key_' + item, default='') | length + +- name: "determine if private key exists ({{ item }})" + stat: + path: "{{ key_path }}" + register: priv_key + +- name: "determine if public key exists ({{ item }}.pub)" + stat: + path: "{{ key_path }}.pub" + register: pub_key + +- name: "derive public key ({{ item }})" + shell: "ssh-keygen -y -f {{ key_path }} > {{ key_path }}.pub" + when: + - not pub_key.stat.exists + - priv_key.stat.exists diff --git a/roles/autossh/tasks/main.yaml b/roles/autossh/tasks/main.yaml new file mode 100644 index 0000000..f0dc374 --- /dev/null +++ b/roles/autossh/tasks/main.yaml @@ -0,0 +1,80 @@ +--- +- name: "create {{ autossh_user }} user" + user: + name: "{{ autossh_user }}" + comment: "{{ autossh_user_comment }}" + password: "{{ autossh_user_password }}" + #password_lock: yes + shell: "{{ autossh_user_shell }}" + generate_ssh_key: yes + state: "{{ autossh_user_state }}" + system: yes + skeleton: /dev/null + +- name: "manage keys {{ item }}" + include: keys.yaml + loop: + - id_dsa + - id_ecdsa + - id_ed25519 + - id_rsa + +- name: create directories + file: + path: "{{ item }}" + owner: root + group: root + mode: 0755 + state: directory + loop: + - "{{ autossh_etc_path }}" + - "{{ autossh_run_path }}" + +- name: install package + package: + name: "{{ autossh_package_name }}" + state: "{{ autossh_package_state }}" +- name: manage keys "{{ item }}" + include: keys.yaml + loop: + - id_dsa + - id_ecdsa + - id_ed25519 + - id_rsa + +- name: manage authorized keys + authorized_key: + user: "{{ autossh_user }}" + key: "{{ item.key }}" + comment: "{{ item.comment | default(omit) }}" + state: "{{ item.state | default('present') }}" + loop: "{{ autossh_authorized_keys | default([]) }}" + +- name: configure systemd unit + template: + src: autossh.service.j2 + dest: "{{ autossh_systemd_unit_path }}" + owner: root + group: root + mode: 0644 + notify: + - reload autossh instances + - autossh daemon-reload + when: ansible_service_mgr == 'systemd' + +- name: configure autossh tunnels + template: + src: autossh.j2 + dest: "{{ autossh_etc_path }}/{{ item.name }}" + owner: root + group: root + mode: 0644 + loop: "{{ autossh_config | default([]) }}" + notify: reload autossh instances + +- name: manage services + service: + name: "autossh@{{ item.name }}.service" + state: "{{ item.state | default('started') }}" + enabled: "{{ item.enabled | default(true) }}" + loop: "{{ autossh_config | default([]) }}" diff --git a/roles/autossh/templates/autossh.j2 b/roles/autossh/templates/autossh.j2 new file mode 100644 index 0000000..18c4a25 --- /dev/null +++ b/roles/autossh/templates/autossh.j2 @@ -0,0 +1,8 @@ +# {{ ansible_managed }} + +AUTOSSH_POLL=60 +AUTOSSH_FIRST_POLL=30 +AUTOSSH_GATETIME=0 +AUTOSSH_PORT=22000 +SSH_OPTIONS="{{ item.options | join(' ') }}" +SSH_HOST={{ item.host }} diff --git a/roles/autossh/templates/autossh.service.j2 b/roles/autossh/templates/autossh.service.j2 new file mode 100644 index 0000000..535a0b9 --- /dev/null +++ b/roles/autossh/templates/autossh.service.j2 @@ -0,0 +1,19 @@ +# {{ ansible_managed }} + +[Unit] +Description=autossh %I +Wants=network-online.target +After=network-online.target + +[Service] +Type=simple +User={{ autossh_user }} +EnvironmentFile={{ autossh_etc_path }}/%i +ExecStart= +ExecStart=/usr/bin/autossh -C -q -l {{ autossh_user }} -N -o ExitOnForwardFailure=yes -o ServerAliveInterval=15 -o ServerAliveCountMax=3 -o StrictHostKeyChecking=no $SSH_OPTIONS $SSH_HOST +Restart=always +RestartSec=60 +PIDFile={{ autossh_run_path }}/%i.pid + +[Install] +WantedBy=multi-user.target