Ansible roles
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

91 lines
2.4 KiB

---
- name: Install packages
yum:
name:
- freeradius
- freeradius-utils
- perl-LWP-Protocol-https # For the check script to be able to fetch CRL on https URL
tags: radius
- name: Create configuration directories
file: path=/etc/radius/{{ item }} state=directory group=radiusd mode=750
with_items:
- certs
- modules
tags: radius
- name: Overwrite radiusd unit file
template: src=radiusd.service.j2 dest=/etc/systemd/system/radiusd.service
register: rad_unit
notify: restart radiusd
tags: radius
- name: Reload systemd
systemd: daemon_reload=True
when: rad_unit.changed
tags: radius
- name: Install client certificate checker script
copy: src=rad_check_client_cert dest=/usr/local/bin/rad_check_client_cert mode=755
tags: radius
- name: Deploy configuration
template: src={{ item }}.j2 dest=/etc/radius/{{ item }} group=radiusd mode=640
with_items:
- radiusd.conf
- clients.conf
- modules/eap.conf
- sites.conf
notify: restart radiusd
tags: radius
- name: Create DH param
shell: /usr/bin/openssl dhparam -out /etc/radius/certs/dh.pem 2048
args:
creates: /etc/radius/certs/dh.pem
notify: restart radiusd
tags: radius
- name: Deploy certificates
copy: content={{ item.content }} dest=/etc/radius/certs/{{ item.dest }} group=radiusd mode={{ item.mode | default(omit) }}
with_items:
- content: "{{ rad_tls_ca }}"
dest: ca.pem
- content: "{{ rad_tls_cert }}"
dest: cert.pem
- content: "{{ rad_tls_key }}"
dest: key.pem
mode: 640
notify: restart radiusd
no_log: True
tags: radius
- name: Deploy CRL
copy: content={{ rad_tls_crl }} dest=/etc/radiusd/certs/crl.pem
when:
- rad_tls_crl is defined
- rad_tls_crl is not search('^https?://')
tags: radius
- name: Deploy tmpfile fragment
template: src=tmpfiles.conf dest=/etc/tmpfiles.d/radiusd.conf
register: rad_tmpfiles
tags: radius
- name: Create tmpfiles
command: systemd-tmpfiles --create
when: rad_tmpfiles.changed
tags: radius
- name: Handle radius ports
iptables_raw:
name: radius_ports
state: "{{ (rad_src_ip | length > 0) | ternary('present','absent') }}"
rules: "-A INPUT -m state --state new -p udp -m multiport --dports {{ rad_ports | join(',') }} -s {{ rad_src_ip | join(',') }} -j ACCEPT"
when: iptables_manage | default(True)
tags: [firewall,radius]
- name: Start and enable the service
service: name=radiusd state=started enabled=True