You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
110 lines
4.1 KiB
110 lines
4.1 KiB
---
|
|
|
|
pki_version: 3.5.6
|
|
pki_archive_url: https://github.com/openxpki/openxpki/archive/v{{ pki_version }}.tar.gz
|
|
pki_archive_sha1: 6fc68022052c56aae50f948e814c267a2726dba1
|
|
|
|
pki_config_version: 3.4
|
|
pki_config_archive_url: https://github.com/openxpki/openxpki-config/archive/v{{ pki_config_version }}.tar.gz
|
|
pki_config_archive_sha1: 3ccbb822fa8d41802394e550775282a662e837d1
|
|
|
|
# Should ansible handle updates or only initial install
|
|
pki_manage_upgrade: True
|
|
|
|
pki_root_dir: /opt/openxpki
|
|
pki_user: openxpki
|
|
|
|
# Database settings
|
|
pki_db_server: "{{ mysql_server | default('localhost') }}"
|
|
pki_db_port: 3306
|
|
pki_db_name: openxpki
|
|
pki_db_user: openxpki
|
|
# If not defined, a random pass will be generated and stored in the meta directory
|
|
# pki_db_pass:
|
|
|
|
# For sessions, use a distinct user, with only access to the frontend_session table
|
|
pki_db_session_user: openxpki_session
|
|
# pki_db_session_pass
|
|
|
|
# Base URL of the PKI
|
|
#pki_base_url: https://pki.domain.tld/openxpki
|
|
# Just a shortcut to get only the path of the url
|
|
pki_web_alias: "{{ pki_base_url | urlsplit('path') }}"
|
|
|
|
# You may restrict access to the web interface by IP
|
|
pki_src_ip:
|
|
- 0.0.0.0/0
|
|
# This is to restrict access to the public endpoints. Eg downloads of CRL
|
|
pki_pub_src_ip: "{{ pki_src_ip }}"
|
|
|
|
# Optional prefix and suffix to append to the Root CA, vault and scep certificates
|
|
pki_cn_prefix: ''
|
|
pki_cn_suffix: ''
|
|
pki_root_ca_cn: "{{ pki_cn_prefix }}Root CA{{ pki_cn_suffix }}"
|
|
pki_vault_cn: "{{ pki_cn_prefix }}Vault Certificate{{ pki_cn_suffix }}"
|
|
pki_scep_cn: "{{ pki_cn_prefix }}SCEP Certificate{{ pki_cn_suffix }}"
|
|
pki_default_realm:
|
|
subj_c: FR
|
|
subj_st: Aquitaine
|
|
subj_l: Bordeaux
|
|
subj_o: Firewall Services
|
|
subj_ou: Security
|
|
validity: 7300 # Root CA will use the double of this value
|
|
keysize: 4096 # Root CA will use the double of this value
|
|
subj_suffix: DC=PKI,DC=Firewall Services,DC=com
|
|
scep:
|
|
enabled: True
|
|
iprange: 0.0.0.0/0
|
|
# hmac: SecretHMAC
|
|
# challenge: SecretChallenge
|
|
profile: I18N_OPENXPKI_PROFILE_TLS_SERVER
|
|
notif:
|
|
admin_email: "{{ system_admin_email }}"
|
|
expiry_send_requestor: False # Should requestor be notified about expiry
|
|
auth:
|
|
ldap_uri: "{{ ad_auth | default(False) | ternary('ldap://' + ad_realm | default(samba_realm) | default(ansible_domain) | lower, ldap_uri) }}"
|
|
ldap_base: "{{ ad_auth | default(False) | ternary('DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC='), ldap_base) }}"
|
|
ldap_start_tls: True
|
|
ldap_user_attr: "{{ ad_auth | default(False) | ternary('samaccountname','uid') }}"
|
|
#ldap_bind_dn:
|
|
#ldap_bind_pass:
|
|
role_map:
|
|
- priority: 10
|
|
filter: "{{ ad_auth | default(False) | ternary('|(memberOf=CN=Domain Admins,CN=Users,DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC=') + ')(memberOf=CN=Domain Admins,OU=Groups,DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC=') + ')', 'posixMemberOf=admins') }}"
|
|
role: 'RA Operator'
|
|
- priority: 20
|
|
filter: "{{ ad_auth | default(False) | ternary('memberOf=CN=Equipe,OU=Groups,DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC='), 'posixMemberOf=equipe') }}"
|
|
role: 'User'
|
|
- priority: 30
|
|
filter: 'cn=*'
|
|
role: 'Anonymous'
|
|
passwd_quality: normal
|
|
# passwd_quality can either be string none, normal or strong. Or a dict
|
|
# for fine grain tuning, with the following keys
|
|
# minlen: 8
|
|
# maxlen: 64
|
|
# groups: 2
|
|
# dictionary: 4
|
|
# following: 3
|
|
# following_keyboard: 3
|
|
|
|
# pki_extra_realm just lets you override some of the defaults, without
|
|
# redefining the whole dict
|
|
pki_extra_realm: {}
|
|
pki_realm_conf: "{{ pki_default_realm | combine(pki_extra_realm, recursive=True) }}"
|
|
|
|
# Auto-generated if not defined
|
|
# those will be used as default HMAC and challenge for realms
|
|
# which doesn't have them defined
|
|
# pki_scep_hmac:
|
|
# pki_scep_challenge:
|
|
|
|
pki_realms:
|
|
- name: vpn
|
|
description: VPN CA
|
|
- name: users
|
|
description: Users CA
|
|
|
|
pki_email_footer_txt: ''
|
|
pki_email_footer_html: ''
|
|
|
|
|