feat: initial commit

2025-06-02 14:55:56 +01:00 · 2025-06-02 14:55:56 +01:00 · 072a1ed764
commit 072a1ed764
36 changed files with 1089 additions and 0 deletions
--- a/roles/podman_identity/defaults/main.yml
+++ b/roles/podman_identity/defaults/main.yml
@ -0,0 +1,17 @@
+---
+podman_identity_certbot_testing: false
+# podman_identity_keycloak_admin_password:
+podman_identity_keycloak_admin_username: admin
+podman_identity_keycloak_hostname: "{{ inventory_hostname }}"
+podman_identity_keycloak_providers:
+  - url: https://github.com/jacekkow/keycloak-protocol-cas/releases/download/26.1.2/keycloak-protocol-cas-26.1.2.jar
+    sha256: de106e8b6b0018a5f121dfa04a14859743e35c5c7ef0abdb01e4a6018d1e2d84
+  - url: https://github.com/sventorben/keycloak-restrict-client-auth/releases/download/v26.0.0/keycloak-restrict-client-auth.jar
+    sha256: 69274e7864f1356f6e14c668787be0c4b8f4d1f4ed28b4e5fa540fa71c8df472
+# podman_identity_ldap_administrator_password:
+# podman_identity_ldap_directory_manager_password:
+# podman_identity_ldap_database_suffix_dn:
+podman_identity_podman_rootless_user: identity
+podman_identity_postgres_keycloak_database: keycloak
+# podman_identity_postgres_keycloak_password:
+podman_identity_postgres_keycloak_username: keycloak
--- a/roles/podman_identity/handlers/main.yml
+++ b/roles/podman_identity/handlers/main.yml
@ -0,0 +1,27 @@
+---
+- name: restart ldap
+  ansible.builtin.systemd_service:
+    name: ldap
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+
+- name: restart postgres
+  ansible.builtin.systemd_service:
+    name: postgres
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+
+- name: restart keycloak
+  ansible.builtin.systemd_service:
+    name: keycloak
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
--- a/roles/podman_identity/tasks/main.yml
+++ b/roles/podman_identity/tasks/main.yml
@ -0,0 +1,218 @@
+---
+# TODO: configure ufw
+
+- name: create service configuration directories
+  ansible.builtin.file:
+    path: "/home/{{ podman_identity_podman_rootless_user }}/{{ item }}"
+    state: directory
+    owner: "{{ podman_identity_podman_rootless_user }}"
+    group: "{{ podman_identity_podman_rootless_user }}"
+    mode: "0755"
+  become: true
+  with_items:
+    - keycloak
+    - ldap
+    - postgres
+
+- name: download keycloak providers
+  ansible.builtin.get_url:
+    url: "{{ item.url }}"
+    dest: "/home/{{ podman_identity_podman_rootless_user }}/keycloak/{{ item.url | basename }}"
+    checksum: "sha256:{{ item.sha256 }}"
+  with_items: "{{ podman_identity_keycloak_providers }}"
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+  notify: restart keycloak
+
+- name: install systemd units for rootless podman user
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_identity_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_identity_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - ldap.container
+    - keycloak.container
+    - postgres.container
+  notify:
+    - "restart {{ item | split('.') | first }}"
+  become: true
+
+- name: install network quadlets for rootless podman user
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_identity_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_identity_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - frontend.network
+    - ldap.network
+    - keycloak.network
+  become: true
+
+- name: verify quadlets are correctly defined
+  ansible.builtin.command: /usr/libexec/podman/quadlet -dryrun -user
+  register: podman_identity_quadlet_result
+  ignore_errors: true
+  changed_when: false
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+
+- name: assert that the quadlet verification succeeded
+  ansible.builtin.assert:
+    that:
+      - podman_identity_quadlet_result.rc == 0
+    fail_msg: "'/usr/libexec/podman/quadlet -dryrun -user' failed! Output withheld to prevent leaking secrets."
+
+- name: start postgres and keycloak
+  ansible.builtin.systemd_service:
+    name: "{{ item }}"
+    state: started
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+  with_items:
+    - postgres
+    - keycloak
+
+- name: set up nginx
+  ansible.builtin.import_role:
+    name: podman_nginx
+  vars:
+    podman_nginx_podman_rootless_user: "{{ podman_identity_podman_rootless_user }}"
+    podman_nginx_primary_hostname: "{{ podman_identity_keycloak_hostname }}"
+    podman_nginx_frontend_network: frontend
+
+- name: start ldap
+  ansible.builtin.systemd_service:
+    name: ldap
+    state: started
+    scope: user
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+
+- name: create nginx configuration file
+  ansible.builtin.template:
+    src: nginx.conf
+    dest: "/home/{{ podman_identity_podman_rootless_user }}/nginx/nginx.conf"
+    owner: "{{ podman_identity_podman_rootless_user }}"
+    group: "{{ podman_identity_podman_rootless_user }}"
+    mode: "0644"
+  become: true
+  notify: restart nginx
+
+- name: wait 30 seconds for ldap server to start
+  ansible.builtin.pause:
+    seconds: 30
+
+- name: create ldap suffix
+  containers.podman.podman_container_exec:
+    name: ldap
+    argv:
+      - dsconf
+      - -v
+      - localhost
+      - backend
+      - create
+      - --suffix
+      - "{{ podman_identity_ldap_database_suffix_dn }}"
+      - --be-name
+      - "{{ podman_identity_ldap_database_backend_name }}"
+      - --create-suffix
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+  register: podman_identity_create_suffix
+  ignore_errors: true
+  changed_when: false
+  tags:
+    - ldap
+
+- name: create suffix result (only when changed)
+  debug:
+    msg: "Suffix was created"
+  when: not podman_identity_create_suffix.failed
+  changed_when: not podman_identity_create_suffix.failed
+
+- name: ldap organisational units
+  community.general.ldap_entry:
+    dn: "ou={{ item }},{{ podman_identity_ldap_database_suffix_dn }}"
+    objectClass:
+      - top
+      - organizationalUnit
+    server_uri: ldaps://{{ inventory_hostname }}/
+    bind_dn: "cn=Directory Manager"
+    bind_pw: "{{ podman_identity_ldap_directory_manager_password }}"
+  delegate_to: localhost
+  with_items:
+    - Administrators
+    - People
+    - Groups
+  environment:
+    - LDAPTLS_REQCERT: "{% if podman_identity_certbot_testing %}never{% else %}always{% endif %}"
+  tags: ldap
+
+- name: enable memberOf plugin
+  containers.podman.podman_container_exec:
+    name: ldap
+    argv:
+      - dsconf
+      - -v
+      - localhost
+      - -D "cn=Directory Manager"
+      - plugin
+      - memberof
+      - enable
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+  tags:
+    - ldap
+
+- name: disable anonymous bind
+  containers.podman.podman_container_exec:
+    name: ldap
+    argv:
+      - dsconf
+      - -v
+      - localhost
+      - -D "cn=Directory Manager"
+      - config
+      - replace
+      - nsslapd-allow-anonymous-access=off
+  become: true
+  become_user: "{{ podman_identity_podman_rootless_user }}"
+  tags:
+    - ldap
+
+- name: ldap read-only administrator
+  community.general.ldap_entry:
+    dn: "uid=admin,ou=Administrators,{{ podman_identity_ldap_database_suffix_dn }}"
+    objectClass:
+      - top
+      - person
+      - organizationalPerson
+      - inetOrgPerson
+    attributes:
+      cn: admin
+      sn: admin
+      userPassword: "{{ podman_identity_ldap_administrator_password }}"
+    server_uri: ldaps://{{ inventory_hostname }}/
+    bind_dn: "cn=Directory Manager"
+    bind_pw: "{{ podman_identity_ldap_directory_manager_password }}"
+  delegate_to: localhost
+  environment:
+    - LDAPTLS_REQCERT: "{% if podman_identity_certbot_testing %}never{% else %}always{% endif %}"
+  tags: ldap
+
+- name: ldap access control information
+  community.general.ldap_attrs:
+    dn: "{{ podman_identity_ldap_database_suffix_dn }}"
+    attributes:
+      aci: '(target="ldap:///{{ podman_identity_ldap_database_suffix_dn }}")(targetattr="*") (version 3.0; acl "readonly"; allow (search,read,compare) userdn="ldap:///uid=admin,ou=Administrators,{{ podman_identity_ldap_database_suffix_dn }}";)'
+    server_uri: ldaps://{{ inventory_hostname }}/
+    bind_dn: "cn=Directory Manager"
+    bind_pw: "{{ podman_identity_ldap_directory_manager_password }}"
+  delegate_to: localhost
+  environment:
+    - LDAPTLS_REQCERT: "{% if podman_identity_certbot_testing %}never{% else %}always{% endif %}"
+  tags: ldap
--- a/roles/podman_identity/templates/frontend.network
+++ b/roles/podman_identity/templates/frontend.network
@ -0,0 +1,5 @@
+[Network]
+Driver=bridge
+
+[Install]
+WantedBy=default.target
--- a/roles/podman_identity/templates/keycloak.container
+++ b/roles/podman_identity/templates/keycloak.container
@ -0,0 +1,33 @@
+[Unit]
+Requires=postgres.service
+After=postgres.service
+
+[Container]
+AutoUpdate=registry
+ContainerName=keycloak
+Environment=\
+    KC_DB=postgres \
+    KC_DB_PASSWORD={{ podman_identity_postgres_keycloak_password }} \
+    KC_DB_URL=jdbc:postgresql://postgres/{{ podman_identity_postgres_keycloak_database }} \
+    KC_DB_USERNAME={{ podman_identity_postgres_keycloak_username }} \
+    KC_HOSTNAME={{ podman_identity_keycloak_hostname }} \
+    KC_HTTP_ENABLED=true \
+    KC_HTTP_PORT=8080 \
+    KC_PROXY_HEADERS=xforwarded \
+    KC_BOOTSTRAP_ADMIN_USERNAME={{ podman_identity_keycloak_admin_username }} \
+    KC_BOOTSTRAP_ADMIN_PASSWORD={{ podman_identity_keycloak_admin_password }} \
+    PROXY_ADDRESS_FORWARDING=true
+Exec=start
+Image=quay.io/keycloak/keycloak:26.1
+Network=keycloak.network
+Network=ldap.network
+Network=frontend.network
+{% for provider in podman_identity_keycloak_providers %}
+Volume=/home/{{ podman_identity_podman_rootless_user }}/keycloak/{{ provider.url | basename }}:/opt/keycloak/providers/{{ provider.url | basename }}:ro
+{% endfor %}
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=default.target
--- a/roles/podman_identity/templates/keycloak.network
+++ b/roles/podman_identity/templates/keycloak.network
@ -0,0 +1,5 @@
+[Network]
+Driver=bridge
+
+[Install]
+WantedBy=default.target
--- a/roles/podman_identity/templates/ldap.container
+++ b/roles/podman_identity/templates/ldap.container
@ -0,0 +1,17 @@
+[Container]
+ContainerName=ldap
+Environment=DS_DM_PASSWORD={{ podman_identity_ldap_directory_manager_password }}
+Image=quay.io/389ds/dirsrv:latest
+Network=ldap.network
+PublishPort=636:3636/tcp
+Volume=/home/{{ podman_identity_podman_rootless_user }}/ldap:/data:rw
+Volume=/home/{{ podman_identity_podman_rootless_user }}/certbot/conf/live/{{ podman_identity_keycloak_hostname }}/privkey.pem:/data/tls/server.key:ro
+Volume=/home/{{ podman_identity_podman_rootless_user }}/certbot/conf/live/{{ podman_identity_keycloak_hostname }}/cert.pem:/data/tls/server.crt:ro
+Volume=/home/{{ podman_identity_podman_rootless_user }}/certbot/conf/live/{{ podman_identity_keycloak_hostname }}/chain.pem:/data/tls/ca/chain.crt:ro
+
+[Service]
+RuntimeMaxSec=604800
+Restart=always
+
+[Install]
+WantedBy=default.target
--- a/roles/podman_identity/templates/ldap.network
+++ b/roles/podman_identity/templates/ldap.network
@ -0,0 +1,5 @@
+[Network]
+Driver=bridge
+
+[Install]
+WantedBy=default.target
--- a/roles/podman_identity/templates/nginx.conf
+++ b/roles/podman_identity/templates/nginx.conf
@ -0,0 +1,39 @@
+# {{ ansible_managed }}
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ podman_identity_keycloak_hostname }};
+    server_tokens off;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://{{ podman_identity_keycloak_hostname }}$request_uri;
+    }
+}
+
+server {
+    listen 443 default_server ssl;
+    listen [::]:443 ssl;
+    http2 on;
+
+    server_name {{ podman_identity_keycloak_hostname }};
+    server_tokens off;
+
+    ssl_certificate /etc/letsencrypt/live/{{ podman_identity_keycloak_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ podman_identity_keycloak_hostname }}/privkey.pem;
+
+    location / {
+        proxy_pass http://keycloak:8080/;
+        proxy_redirect off;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port 443;
+    }
+}
--- a/roles/podman_identity/templates/postgres.container
+++ b/roles/podman_identity/templates/postgres.container
@ -0,0 +1,15 @@
+[Container]
+AutoUpdate=registry
+ContainerName=postgres
+Environment=\
+  POSTGRES_DB={{ podman_identity_postgres_keycloak_database }} \
+  POSTGRES_PASSWORD={{ podman_identity_postgres_keycloak_password }} \
+  POSTGRES_USER={{ podman_identity_postgres_keycloak_username }} \
+  POSTGRES_HOST_AUTH_METHOD=scram-sha-256 \
+  POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
+Image=docker.io/postgres:17.3
+Network=keycloak.network
+Volume=/home/{{ podman_identity_podman_rootless_user }}/postgres:/var/lib/postgresql/data:rw
+
+[Install]
+WantedBy=default.target