Merge pull request 'dev' (#22) from dev into master

Reviewed-on: http://89.110.105.223:8080/IaC/rproxy/pulls/22

Jenkinsfile

@@ -25,9 +25,9 @@ pipeline {
             }
             steps {
                 script {
-                    def ask_for_certs = input message: 'Upload RootCA certificate and key', parameters: [base64File(name: 'rootca'), base64File(name: 'rootca_key')]
+                    def userInput = input message: 'Upload RootCA certificate and key', parameters: [base64File(name: 'rootca'), base64File(name: 'rootca_key')]
-                    sh 'echo "${ask_for_certs["rootca"]}" > roles/rproxy/files/RootCA.crt'
+                    writeFile(file: 'roles/rproxy/files/RootCA.crt', text: new String(userInput['rootca'].decodeBase64()))
-                    sh 'echo "${ask_for_certs["rootca_key"]}" > roles/rproxy/files/RootCA.key'
+                    writeFile(file: 'roles/rproxy/files/RootCA.key', text: new String(userInput['rootca_key'].decodeBase64()))
                 }
             }
         }

roles/rproxy/files/repo.conf

@@ -1,8 +1,16 @@
 server {
-    listen 9000;
+    listen 9000 default ssl;
     server_name _;
     root /repo;
 
+    ssl_certificate /etc/nginx/certs/repo.crt;
+    ssl_certificate_key /etc/nginx/certs/repo.key;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers EECDH:+AES256:-3DES:!RSA+AES:!RSA+3DES:!NULL:!RC4;
+    ssl_prefer_server_ciphers on;
+
+    error_page 497 301 =307 https://$host:$server_port$request_uri;
+
     location / {
         charset utf-8;
         autoindex on;

roles/rproxy/tasks/main.yml

@@ -7,6 +7,13 @@
     - install
     - add_config
 
+- name: Get IP address
+  ansible.builtin.shell:
+    cmd: hostname -I | awk '{print $1}'
+  register: IP
+  tags:
+    - install
+
 - name: Install docker (Debian)
   ansible.builtin.apt:
     name:
@@ -51,12 +58,6 @@
         path: "{{ rproxy_dir }}/sites"
         state: directory
 
-    - name: Create repo dir
-      ansible.builtin.file:
-        path: "{{ rproxy_dir }}/repo"
-        state: directory
-        mode: 0777
-
     - name: Create certs dir
       ansible.builtin.file:
         path: "{{ rproxy_dir }}/certs"
@@ -64,7 +65,7 @@
 
     - name: Copy docker-compose
       ansible.builtin.template:
-        src: templates/docker-compose.yml.j2
+        src: templates/docker-compose.rproxy.yml.j2
         dest: "{{ rproxy_dir }}/docker-compose.yml"
 
     - name: Copy nginx.conf
@@ -72,11 +73,6 @@
         src: files/nginx.conf
         dest: "{{ rproxy_dir }}/nginx.conf"
 
-    - name: Copy repo.conf
-      ansible.builtin.copy:
-        src: files/repo.conf
-        dest: "{{ rproxy_dir }}/sites/repo.conf"
-
     - name: Copy RootCA certificate
       ansible.builtin.copy:
         src: files/RootCA.crt
@@ -92,6 +88,122 @@
         project_src: "{{ rproxy_dir }}"
   tags: install
 
+- name: Create https repository
+  block:
+    - name: Create repo dir
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/repo"
+        state: directory
+        mode: 0777
+
+    - name: Copy repo.conf
+      ansible.builtin.copy:
+        src: files/repo.conf
+        dest: "{{ rproxy_dir }}/sites/repo.conf"
+
+    - name: Copy repo certificate cnf
+      ansible.builtin.template:
+        src: templates/repo.cnf.j2
+        dest: '{{ rproxy_dir }}/certs/repo.cnf'
+
+    - name: Generate repo certificate key
+      ansible.builtin.shell:
+        cmd: 'openssl genrsa -out {{ rproxy_dir }}/certs/repo.key 2048'
+
+    - name: Generate server csr
+      ansible.builtin.shell:
+        cmd: 'openssl req -key {{ rproxy_dir }}/certs/repo.key -new -out {{ rproxy_dir }}/certs/repo.csr -config {{ rproxy_dir }}/certs/repo.cnf'
+
+    - name: Sign server certificate
+      ansible.builtin.shell:
+        cmd: 'openssl x509 -req -CA {{ rproxy_dir }}/certs/RootCA.crt -CAkey {{ rproxy_dir }}/certs/RootCA.key -in {{ rproxy_dir }}/certs/repo.csr -out {{ rproxy_dir }}/certs/repo.crt -CAcreateserial -extfile {{ rproxy_dir }}/certs/repo.cnf -days 365 -extensions v3_x509'
+
+    - name: Create fullchain certificate
+      ansible.builtin.shell:
+        cmd: 'cat {{ rproxy_dir }}/certs/RootCA.crt >> {{ rproxy_dir }}/certs/repo.crt'
+
+    - name: Delete csr
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/certs/repo.csr"
+        state: absent
+
+    - name: Delete cnf
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/certs/repo.cnf"
+        state: absent
+
+    - name: Restart rproxy
+      community.docker.docker_compose:
+        project_src: "{{ rproxy_dir }}"
+        build: false
+        restarted: true
+  tags: install
+
+- name: Create docker repository
+  block:
+    - name: Remove dockerrepo dir
+      ansible.builtin.file:
+        path: "{{ dockerrepo_dir }}"
+        state: absent
+
+    - name: Create dockerrepo dir
+      ansible.builtin.file:
+        path: "{{ dockerrepo_dir }}"
+        state: directory
+
+    - name: Create repo dir
+      ansible.builtin.file:
+        path: "{{ dockerrepo_dir }}/repo"
+        state: directory
+
+    - name: Create certs dir
+      ansible.builtin.file:
+        path: "{{ dockerrepo_dir }}/certs"
+        state: directory
+
+    - name: Copy docker-compose
+      ansible.builtin.template:
+        src: templates/docker-compose.dockerrepo.yml.j2
+        dest: "{{ dockerrepo_dir }}/docker-compose.yml"
+
+    - name: Copy dockerrepo certificate cnf
+      ansible.builtin.template:
+        src: templates/dockerrepo.cnf.j2
+        dest: '{{ dockerrepo_dir }}/certs/dockerrepo.cnf'
+
+    - name: Generate dockerrepo certificate key
+      ansible.builtin.shell:
+        cmd: 'openssl genrsa -out {{ dockerrepo_dir }}/certs/dockerrepo.key 2048'
+
+    - name: Generate dockerrepo csr
+      ansible.builtin.shell:
+        cmd: 'openssl req -key {{ dockerrepo_dir }}/certs/dockerrepo.key -new -out {{ dockerrepo_dir }}/certs/dockerrepo.csr -config {{ dockerrepo_dir }}/certs/dockerrepo.cnf'
+
+    - name: Sign dockerrepo certificate
+      ansible.builtin.shell:
+        cmd: 'openssl x509 -req -CA {{ rproxy_dir }}/certs/RootCA.crt -CAkey {{ rproxy_dir }}/certs/RootCA.key -in {{ dockerrepo_dir }}/certs/dockerrepo.csr -out {{ dockerrepo_dir }}/certs/dockerrepo.crt -CAcreateserial -extfile {{ dockerrepo_dir }}/certs/dockerrepo.cnf -days 365 -extensions v3_x509'
+
+    - name: Create fullchain certificate
+      ansible.builtin.shell:
+        cmd: 'cat {{ rproxy_dir }}/certs/RootCA.crt >> {{ dockerrepo_dir }}/certs/dockerrepo.crt'
+
+    - name: Delete csr
+      ansible.builtin.file:
+        path: "{{ dockerrepo_dir }}/certs/dockerrepo.csr"
+        state: absent
+
+    - name: Delete cnf
+      ansible.builtin.file:
+        path: "{{ dockerrepo_dir }}/certs/dockerrepo.cnf"
+        state: absent
+
+    - name: Restart rproxy
+      community.docker.docker_compose:
+        project_src: "{{ dockerrepo_dir }}"
+        build: false
+        restarted: true
+  tags: install
+
 - name: Create configs
   block:
     - name: Copy server.conf

roles/rproxy/templates/docker-compose.dockerrepo.yml.j2

@@ -0,0 +1,15 @@
+version: '3.3'
+
+services:
+  nginx:
+    image: registry:latest
+    container_name: dockerrepo
+    restart: always
+    environment:
+      - REGISTRY_HTTP_TLS_CERTIFICATE=/certs/dockerrepo.crt
+      - REGISTRY_HTTP_TLS_KEY=/certs/dockerrepo.key
+    volumes:
+      - {{ dockerrepo_dir }}/repo:/var/lib/registry
+      - {{ dockerrepo_dir }}/certs:/certs
+    ports:
+      - 5000:5000

roles/rproxy/templates/dockerrepo.cnf.j2

@@ -0,0 +1,29 @@
+[ req ]
+prompt                 = no
+distinguished_name     = dockerrepo.{{ domain.stdout }}
+req_extensions         = v3_req
+x509_extensions		   = v3_x509
+
+
+[ dockerrepo.{{ domain.stdout }} ]
+countryName            = RU
+stateOrProvinceName    = RU
+localityName           = MSK
+organizationName       = {{ domain.stdout }}
+organizationalUnitName = IT
+commonName             = dockerrepo.{{ domain.stdout }}
+emailAddress           = admin@{{ domain.stdout }}
+
+[ v3_req ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ v3_x509 ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ sans ]
+DNS.1 = dockerrepo.{{ domain.stdout }}
+IP.1 = {{ IP.stdout }}

roles/rproxy/templates/repo.cnf.j2

@@ -0,0 +1,29 @@
+[ req ]
+prompt                 = no
+distinguished_name     = repo.{{ domain.stdout }}
+req_extensions         = v3_req
+x509_extensions		   = v3_x509
+
+
+[ repo.{{ domain.stdout }} ]
+countryName            = RU
+stateOrProvinceName    = RU
+localityName           = MSK
+organizationName       = {{ domain.stdout }}
+organizationalUnitName = IT
+commonName             = repo.{{ domain.stdout }}
+emailAddress           = admin@{{ domain.stdout }}
+
+[ v3_req ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ v3_x509 ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ sans ]
+DNS.1 = repo.{{ domain.stdout }}
+IP.1 = {{ IP.stdout }}

rproxy.yml

@@ -5,6 +5,7 @@
   vars:
     ansible_python_interpreter: /usr/bin/python3
     rproxy_dir: /opt/rproxy
+    dockerrepo_dir: /opt/dockerrepo
   
   vars_prompt:
     - name: rproxy_service_name