Merge pull request 'dev' (#3) from dev into master

Reviewed-on: http://remvpn.olsson.ul:8080/Ansible/rproxy/pulls/3

Jenkinsfile

@@ -4,16 +4,57 @@ pipeline {
         string(name: "target_host", defaultValue: "", trim: true, description: "Target host")
         string(name: "username", defaultValue: "", trim: true, description: "Ansible user")
         password(name: "password", defaultValue: "", description: "Ansible password")
+        booleanParam(name: "rproxy_install", defaultValue: true, description: "Install Rproxy")
+        base64File(name: "rootca", description: "RootCA (only for 'Install Rproxy')")
+        base64File(name: "rootca_key", description: "RootCA key (only for 'Install Rproxy')")
+        booleanParam(name: "config_add", defaultValue: true, description: "Add config")
+        string(name: "rproxy_service_name", defaultValue: "", trim: true, description: "Service name (for 'Add config' job only)")
+        string(name: "rproxy_service_port", defaultValue: "", trim: true, description: "Service port (for 'Add config' job only)")
+        string(name: "rproxy_service_address", defaultValue: "", trim: true, description: "Service address (for 'Add config' job only)")
+
     }
     stages {
-        stage('Download') {
+        stage('Save certs') {
+            when {
+                expression {
+                    return params.rproxy_install
+                }
+            }
             steps {
-                git branch: 'master', url:'${git_url}/Ansible/rproxy.git', credentialsId: 'git'
+                withFileParameter('rootca') {
+                    sh 'mv ${rootca} roles/rproxy/files/RootCA.crt'
+                }
+                withFileParameter('rootca_key') {
+                    sh 'mv ${rootca_key} roles/rproxy/files/RootCA.key'
+                }
             }
         }
-        stage('Run') {
+        stage('Install Rproxy') {
+            when {
+                expression {
+                    return params.rproxy_install
+                }
+            }
             steps {
-                sh 'ansible-playbook rproxy.yml -i ${target_host}, -u ${username} -e "ansible_password=${password}"'
+                script {
+                    wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: params.password]]]) { 
+                        sh 'ansible-playbook rproxy.yml -i ${target_host}, -t install -u ${username} -e "ansible_password=${password} rproxy_service_name=${rproxy_service_name} rproxy_service_port=${rproxy_service_port} rproxy_service_address=${rproxy_service_address}"'
+                    }
+                }
+            }
+        }
+        stage('Add config') {
+            when {
+                expression {
+                    return params.config_add
+                }
+            }
+            steps {
+                script {
+                    wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: params.password]]]) { 
+                        sh 'ansible-playbook rproxy.yml -i ${target_host}, -t add_config -u ${username} -e "ansible_password=${password} rproxy_service_name=${rproxy_service_name} rproxy_service_port=${rproxy_service_port} rproxy_service_address=${rproxy_service_address}"'
+                    }
+                }
             }
         }
     }

roles/rproxy/files/nginx.conf

@@ -1,4 +1,3 @@
-load_module modules/ngx_http_headers_more_filter_module.so;
 user  nginx;
 worker_processes  auto;
 
@@ -20,14 +19,8 @@ http {
                       '"$http_user_agent" "$http_x_forwarded_for"';
 
     access_log  /var/log/nginx/access.log  main;
-
     sendfile        on;
-    #tcp_nopush     on;
-
     keepalive_timeout  65;
-
-    #gzip  on;
-
     include /etc/nginx/sites/*.conf;
     server_tokens off;
 }

roles/rproxy/tasks/main.yml

@@ -3,44 +3,106 @@
   ansible.builtin.shell:
     cmd: hostname -d
   register: domain
+  tags:
+    - install
+    - add_config
 
-- name: Install dependencies
+- name: Install rproxy
-  ansible.builtin.apt:
+  block:
-    name:
+    - name: Install dependencies
-      - docker.io
+      ansible.builtin.apt:
-      - docker-compose
+        name:
-    update_cache: yes
+          - docker.io
+          - docker-compose
+        update_cache: yes
 
-- name: Remove rproxy dir
+    - name: Remove rproxy dir
-  ansible.builtin.file:
+      ansible.builtin.file:
-    path: {{ rproxy_dir }}
+        path: "{{ rproxy_dir }}"
-    state: absent
+        state: absent
 
-- name: Create rproxy dir
+    - name: Create rproxy dir
-  ansible.builtin.file:
+      ansible.builtin.file:
-    path: {{ rproxy_dir }}
+        path: "{{ rproxy_dir }}"
-    state: directory
+        state: directory
 
-- name: Create sites dir
+    - name: Create sites dir
-  ansible.builtin.file:
+      ansible.builtin.file:
-    path: "{{ rproxy_dir }}/sites"
+        path: "{{ rproxy_dir }}/sites"
-    state: directory
+        state: directory
 
-- name: Copy docker-compose
+    - name: Create certs dir
-  ansible.builtin.template:
+      ansible.builtin.file:
-    src: templates/docker-compose.yml.j2
+        path: "{{ rproxy_dir }}/certs"
-    dest: "{{ rproxy_dir }}/docker-compose.yml"
+        state: directory
 
-- name: Copy nginx.conf
+    - name: Copy docker-compose
-  ansible.builtin.copy:
+      ansible.builtin.template:
-    src: files/nginx.conf
+        src: templates/docker-compose.yml.j2
-    dest: "{{ rproxy_dir }}/nginx.conf"
+        dest: "{{ rproxy_dir }}/docker-compose.yml"
 
-- name: Copy server.conf
+    - name: Copy nginx.conf
-  ansible.builtin.template:
+      ansible.builtin.copy:
-    src: templates/server.conf.j2
+        src: files/nginx.conf
-    dest: "{{ rproxy_dir }}/sites/server.conf"
+        dest: "{{ rproxy_dir }}/nginx.conf"
+
+    - name: Copy RootCA certificate
+      ansible.builtin.copy:
+        src: files/RootCA.crt
+        dest: '{{ rproxy_dir }}/certs/RootCA.crt'
+    
+    - name: Copy RootCA key
+      ansible.builtin.copy:
+        src: files/RootCA.key
+        dest: '{{ rproxy_dir }}/certs/RootCA.key'
+
+    - name: Start rproxy
+      community.docker.docker_compose:
+        project_src: "{{ rproxy_dir }}"
+  tags: install
+
+- name: Create configs
+  block:
+    - name: Copy server.conf
+      ansible.builtin.template:
+        src: templates/server.conf.j2
+        dest: "{{ rproxy_dir }}/sites/{{  rproxy_service_name  }}.conf"
+
+    - name: Copy server certificate cnf
+      ansible.builtin.template:
+        src: templates/server.cnf.j2
+        dest: '{{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.cnf'
+
+    - name: Generate server key
+      ansible.builtin.shell:
+        cmd: 'openssl genrsa -out {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.key 2048'
+
+    - name: Generate server csr
+      ansible.builtin.shell:
+        cmd: 'openssl req -key {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.key -new -out {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.csr -config {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.cnf'
+
+    - name: Sign server certificate
+      ansible.builtin.shell:
+        cmd: 'openssl x509 -req -CA {{ rproxy_dir }}/certs/RootCA.crt -CAkey {{ rproxy_dir }}/certs/RootCA.key -in {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.csr -out {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.crt -CAcreateserial -extfile {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.cnf -days 365 -extensions v3_x509'
+
+    - name: Create fullchain certificate
+      ansible.builtin.shell:
+        cmd: 'cat {{ rproxy_dir }}/certs/RootCA.crt >> {{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.crt'
+
+    - name: Delete csr
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.csr"
+        state: absent
+
+    - name: Delete cnf
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/certs/{{  rproxy_service_name  }}.cnf"
+        state: absent
+
+    - name: Restart rproxy
+      community.docker.docker_compose:
+        project_src: "{{ rproxy_dir }}"
+        build: false
+        restarted: true
+  tags: add_config
 
-- name: Start rproxy
-  community.docker.docker_compose:
-    project_src: "{{ rproxy_dir }}"

roles/rproxy/templates/docker-compose.yml.j2

@@ -3,14 +3,12 @@ version: '3.3'
 services:
   nginx:
     image: nginx:latest
-    container_name: nginx
+    container_name: rproxy
     restart: always
     volumes:
       - {{ rproxy_dir }}/nginx.conf:/etc/nginx/nginx.conf
       - {{ rproxy_dir }}/sites:/etc/nginx/sites
-      - {{ rproxy_dir }}/sites/default.conf:/etc/nginx/conf.d/default.conf
+      - {{ rproxy_dir }}/certs:/etc/nginx/certs
-      - {{ rproxy_dir }}/{{ domain.stdout }}.crt:/etc/nginx/{{ domain.stdout }}.crt
-      - {{ rproxy_dir }}/{{ domain.stdout }}.key:/etc/nginx/{{ domain.stdout }}.key
     ports:
       - 443:443
       - 80:80

roles/rproxy/templates/server.cnf.j2

@@ -0,0 +1,29 @@
+[ req ]
+prompt                 = no
+distinguished_name     = {{ rproxy_service_name }}.{{ domain.stdout }}
+req_extensions         = v3_req
+x509_extensions		   = v3_x509
+
+
+[ {{  rproxy_service_name  }}.{{ domain.stdout }} ]
+countryName            = RU
+stateOrProvinceName    = RU
+localityName           = MSK
+organizationName       = {{ domain.stdout }}
+organizationalUnitName = IT
+commonName             = {{ rproxy_service_name }}.{{ domain.stdout }}
+emailAddress           = admin@{{ domain.stdout }}
+
+[ v3_req ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ v3_x509 ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ sans ]
+DNS.1 = {{ rproxy_service_name }}.{{ domain.stdout }}
+IP.1 = {{ rproxy_service_address }}

roles/rproxy/templates/server.conf.j2

@@ -1,32 +1,35 @@
-{% for rproxy_service in rproxy_service_list %}
+upstream {{ rproxy_service_name }}.{{ domain.stdout }} {
+    server {{ rproxy_service_address }}:{{ rproxy_service_port }};
+}
+
 server {
     listen 80;
-    server_name {{ rproxy_service }}.{{ domain.stdout }};
+    server_name {{ rproxy_service_name }}.{{ domain.stdout }};
-    access_log /var/log/nginx/{{ rproxy_service }}.access.log;
+    access_log /var/log/nginx/{{ rproxy_service_name }}.access.log;
-    error_log /var/log/nginx/{{ rproxy_service }}.error.log;
+    error_log /var/log/nginx/{{ rproxy_service_name }}.error.log;
     return 301 https://$server_name$request_uri;
 }
 
 server {
     listen 443 ssl;
-    server_name {{ rproxy_service }}.{{ domain.stdout }};
+    server_name {{ rproxy_service_name }}.{{ domain.stdout }};
-    access_log /var/log/nginx/{{ rproxy_service }}.access.log;
+    access_log /var/log/nginx/{{ rproxy_service_name }}.access.log;
-    error_log /var/log/nginx/{{ rproxy_service }}.error.log;
+    error_log /var/log/nginx/{{ rproxy_service_name }}.error.log;
-    ssl_certificate /etc/nginx/{{ domain.stdout }}.crt;
+    ssl_certificate /etc/nginx/certs/{{  rproxy_service_name  }}.crt;
-    ssl_certificate_key /etc/nginx/{{ domain.stdout }}.key;
+    ssl_certificate_key /etc/nginx/certs/{{  rproxy_service_name  }}.key;
     ssl_protocols TLSv1.2;
     ssl_ciphers EECDH:+AES256:-3DES:!RSA+AES:!RSA+3DES:!NULL:!RC4;
     ssl_prefer_server_ciphers on;
     proxy_connect_timeout 600s;
     fastcgi_request_buffering off;
     fastcgi_buffers 64 4K;
+
     location / {
         proxy_pass_header Server;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass https://{{ rproxy_service }}.{{ domain.stdout }}/;
+        proxy_pass http://{{ rproxy_service_name }}.{{ domain.stdout }}/;
      }
 }
-{% endfor %}

rproxy.yml

@@ -5,7 +5,16 @@
   vars:
     ansible_python_interpreter: /usr/bin/python3
     rproxy_dir: /opt/rproxy
-    rproxy_service_list: [jenkins]
   
+  vars_prompt:
+    - name: rproxy_service_name
+      prompt: Enter service for rproxy
+
+    - name: rproxy_service_port
+      prompt: Enter service for rproxy
+
+    - name: rproxy_service_address
+      prompt: Enter service for rproxy
+
   roles:
     - rproxy