summaryrefslogtreecommitdiff
path: root/roles/gnupg
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@fretlink.com>2018-11-06 12:09:50 +0100
committerIsmaël Bouya <ismael.bouya@fretlink.com>2018-11-06 12:16:15 +0100
commitb6984948ccd39e4aba15f02822703edebecb6bb7 (patch)
tree81987f45d9dcc723aefc0b769f4c47aefe295a56 /roles/gnupg
parentc235f9bea368316f1c1a441ebf6877e05e7df21c (diff)
downloadAnsible-b6984948ccd39e4aba15f02822703edebecb6bb7.tar.gz
Ansible-b6984948ccd39e4aba15f02822703edebecb6bb7.tar.zst
Ansible-b6984948ccd39e4aba15f02822703edebecb6bb7.zip
Add gpg configuration, key generation and password store
Diffstat (limited to 'roles/gnupg')
-rw-r--r--roles/gnupg/handlers/main.yml15
-rw-r--r--roles/gnupg/tasks/main.yml62
-rw-r--r--roles/gnupg/templates/gen-key-script.j26
3 files changed, 82 insertions, 1 deletions
diff --git a/roles/gnupg/handlers/main.yml b/roles/gnupg/handlers/main.yml
new file mode 100644
index 0000000..d32d321
--- /dev/null
+++ b/roles/gnupg/handlers/main.yml
@@ -0,0 +1,15 @@
1---
2- name: restart gpg-agent
3 systemd:
4 state: restarted
5 name: gpg-agent.service
6 scope: user
7- name: notify add key to immae@immae.eu
8 pause:
9 prompt: "gpg key will be sent to immae.eu, please login to tmux and give passwords there."
10 seconds: 3
11- name: send key to immae@immae.eu
12 shell: "gpg --armor --export ismael@flony | ssh immae@immae.eu add_workstation_key | gpg --import -"
13- name: notify add key to password store
14 pause:
15 prompt: "Please add the key to the password store and push: pass init -p Folder/Folder <key> <key>. Press key when done"
diff --git a/roles/gnupg/tasks/main.yml b/roles/gnupg/tasks/main.yml
index 8adaf69..d1289f5 100644
--- a/roles/gnupg/tasks/main.yml
+++ b/roles/gnupg/tasks/main.yml
@@ -12,8 +12,64 @@
12 state: directory 12 state: directory
13 mode: 0700 13 mode: 0700
14- name: Get gnupg runtime folder name 14- name: Get gnupg runtime folder name
15 shell: 'GNUPGHOME=$XDG_CONFIG_HOME/gnupg gpgconf --list-dirs socketdir | sed -e "s@$XDG_RUNTIME_DIR/gnupg/@@"' 15 shell: 'gpgconf --list-dirs socketdir | sed -e "s@$XDG_RUNTIME_DIR/gnupg/@@"'
16 register: gnupg_runtime_dir_cmd 16 register: gnupg_runtime_dir_cmd
17 changed_when: false
18- name: check existing secret key
19 shell: "gpg --list-secret-keys | grep '{{ gpg_useremail }}'"
20 changed_when: false
21 ignore_errors: true
22 register: gpgkeys
23- name: ask for gpg password
24 pause:
25 prompt: "Chose gpg password"
26 echo: false
27 register: gpg_password
28 when: gpgkeys is defined and "stdout" in gpgkeys and gpgkeys.stdout == ""
29- name: confirm gpg password
30 pause:
31 prompt: "Confirm gpg password"
32 echo: false
33 register: gpg_password_confirm
34 when: gpgkeys is defined and "stdout" in gpgkeys and gpgkeys.stdout == ""
35- name: check gpg password
36 assert:
37 that: gpg_password_confirm.user_input == gpg_password.user_input
38 when: gpgkeys is defined and "stdout" in gpgkeys and gpgkeys.stdout == ""
39- name: copy default template for gpg key generation
40 template:
41 src: gen-key-script.j2
42 dest: "$XDG_CONFIG_HOME/gnupg/gen-key-script-{{ gpg_user }}"
43 mode: 0600
44 no_log: true
45 when: gpgkeys is defined and "stdout" in gpgkeys and gpgkeys.stdout == ""
46- name: generate gpg key
47 command: "gpg --batch --gen-key $XDG_CONFIG_HOME/gnupg/gen-key-script-{{ gpg_user }}"
48 when: gpgkeys is defined and "stdout" in gpgkeys and gpgkeys.stdout == ""
49 register: genkey
50- name: remove template file
51 file:
52 path: "$XDG_CONFIG_HOME/gnupg/gen-key-script-{{ gpg_user }}"
53 state: absent
54 when: gpgkeys is defined and "stdout" in gpgkeys and gpgkeys.stdout == ""
55- name: get keygrip
56 shell: "gpg -K --with-colons {{ gpg_useremail }} | grep '^grp' | cut -d':' -f10"
57 register: keygrip
58 when: gpgkeys is defined and "stdout" in gpgkeys and gpgkeys.stdout == ""
59 notify:
60 - notify add key to immae@immae.eu
61 - send key to immae@immae.eu
62 - notify add key to password store
63- name: add keygrip to sshcontrol
64 lineinfile:
65 line: "{{ keygrip.stdout }}"
66 insertafter: EOF
67 dest: "$XDG_CONFIG_HOME/gnupg/sshcontrol"
68 create: true
69 state: present
70 when: keygrip is defined and "stdout" in keygrip and keygrip.stdout != ""
71 notify:
72 - restart gpg-agent
17- name: Add systemd overrides 73- name: Add systemd overrides
18 template: 74 template:
19 src: "systemd/{{ item }}.conf.j2" 75 src: "systemd/{{ item }}.conf.j2"
@@ -32,3 +88,7 @@
32 state: restarted 88 state: restarted
33 name: "{{ item }}.socket" 89 name: "{{ item }}.socket"
34 loop: "{{ results.results|selectattr('changed')|map(attribute='item')|list }}" 90 loop: "{{ results.results|selectattr('changed')|map(attribute='item')|list }}"
91- name: clone password store
92 register: clone_password_store
93 shell: "cd $(dirname $ANSIBLE_CONFIG ); git submodule update --init password_store"
94 changed_when: clone_password_store is defined and "stdout" in clone_password_store and clone_password_store.stdout != ""
diff --git a/roles/gnupg/templates/gen-key-script.j2 b/roles/gnupg/templates/gen-key-script.j2
new file mode 100644
index 0000000..0687068
--- /dev/null
+++ b/roles/gnupg/templates/gen-key-script.j2
@@ -0,0 +1,6 @@
1Key-Type: RSA
2Key-Length: 4096
3Key-Usage: cert encrypt auth
4Name-Real: {{ gpg_realname }}
5Name-Email: {{ gpg_useremail }}
6Passphrase: {{ gpg_password.user_input }}