ssh.yaml

---
#
# No Fuss Computing
# https://gitlab.com/nofusscomputing/projects/ansible/ansible_playbooks
#
# Playbook for running the nfc_ssh role.
# tags must be sepcified for the playbook to function.
#
# image: nofusscomputing/ansible-ee >= 0.4.0rc1
#
# Tags:
#
#   - check
#     Check the host certificate
#
#   - configure
#     Configure an existing OpenSSH installation
#
#   - install
#     Install and Configure OpenSSH
#
#   - renew
#     Renew the hosts SSH Keys (and Resign with the Host CA if enabled)
#
- name: OpenSSH Server Setup
  hosts: all
  become: true
  gather_facts: true


  pre_tasks:


      # Play and task set time
    - name: Set Start Time
      ansible.builtin.set_fact:
        nfc_task_starttime: "{{ ('%Y-%m-%dT%H:%M:%S %z' | strftime) | string }}"
      no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
      tags:
        - always


    # Setup dictionary 'nfc_automation'
    - name: Set Automation Facts
      ansible.builtin.set_fact:
        nfc_automation: {
          "time": {
            "start": "{{ nfc_task_starttime | string }}",
            "end": 0
          }
        }
      no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
      when: nfc_automation is not defined
      tags:
        - always


    # Setup dictionary 'nfc_task'
    - name: Set Automation Facts
      ansible.builtin.set_fact:
        nfc_task: {
          "name": "{{ ansible_play_name | default('') | lower | string }}",
          "error": 0,
          "roles": "{{ ansible_play_role_names | default('') | string }}",
          "skip_tags": "{{ ansible_skip_tags | default([])| list }}",
          "start": "{{ nfc_task_starttime | string }}",
          "tags": "{{ ansible_run_tags | default([]) | list }}"
        }
      no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
      tags:
        - always


    - name: Block - pre_tasks
      block:


        - name: Variable Setup - project_dir
          ansible.builtin.include_tasks:
            file: tasks/var_project_dir.yaml
            apply:
              tags:
                - always
          when: var_project_dir is not defined
          tags:
            - always


      rescue:

          # there was an error, set error object
        - name: Set error fact
          ansible.builtin.set_fact:
            nfc_task: "{{ nfc_task | combine({
                'error': 1
              }) }}"
          no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
          tags:
            - always


      always:


          # Check if error occured and fail task
        - name: Error Check
          ansible.builtin.assert:
            that:
              - nfc_task.error | int == 0
            msg: Error occured, Fail the play run
          tags:
            - always


    # Don't use the 'roles' section.
  roles: []
    # if the included role(s) do not contain a rescue block, the playbook may stop
    # executing in this section (roles) with the post_tasks not running. This will
    # cause the artifacts to be incomplete. It's recommended to include your roles
    # in section(s) 'pre_tasks', 'tasks' or 'post_tasks' and from within a block with
   # rescue so that the playbook can complete and ensure that all artifacts are set.


  tasks:


    - name: Block - tasks
      block:

          # Check for error and fail play on error
        - name: Error Check
          ansible.builtin.assert:
            that:
              - nfc_task.error | int == 0
            msg: Error eccured, follow error path to fail play
          tags:
            - always


        - name: SSH Install
          ansible.builtin.include_role:
            name: nfc_ssh
          tags:
            - always


      rescue:


          # there was an error, set error object
        - name: Set error fact
          ansible.builtin.set_fact:
            nfc_task: "{{ nfc_task | combine({
                'error': 1
              }) }}"
          no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
          tags:
            - always


      always:


          # Check if error occured and fail task
        - name: Error Check
          ansible.builtin.assert:
            that:
              - nfc_task.error | int == 0
            msg: Error occured, Fail the play run
          tags:
            - always


  post_tasks:

    - name: Tasks post_task
      block:


          # Check for error and fail play on error
        - name: Error Check
          ansible.builtin.assert:
            that:
              - nfc_task.error | int == 0
            msg: Error occured, follow error path to fail play
          tags:
            - always


        ########################################################################
        #
        # Your tasks here
        #
        ########################################################################


      rescue:


          # there was an error, set error object
        - name: Set error fact
          ansible.builtin.set_fact:
            nfc_task: "{{ nfc_task | combine({
                'error': 1
              }) }}"
          no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
          tags:
            - always


      always:


          # Task and automation end time.
        - name: Fetch End time
          ansible.builtin.set_fact:
            nfc_task_endtime: "{{ '%Y-%m-%dT%H:%M:%S %z' | strftime }}"
          no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
          tags:
            - always


          # Set task end time
        - name: Set task Facts
          ansible.builtin.set_fact:
            nfc_tasks: "{{ nfc_tasks | default([]) + [ nfc_task | combine({
                'end': nfc_task_endtime | string
              }) ] }}"
          no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
          tags:
            - always


          # Set Automation end time.
          # every playbook must set this variable so that the end time
          # is equal to the fail time or the end of a group of playbooks.
        - name: Set automation end time
          ansible.builtin.set_fact:
            nfc_automation: "{{ nfc_automation | combine({
                'time': nfc_automation.time | combine({
                  'end': nfc_task_endtime | string
                })
              }) }}"
            nfc_task_endtime: null
          no_log: "{{ nfc_pb_no_log_setup_facts | default(false) | bool }}"
          tags:
            - always


          # Set the artifacts as a fact for subsequent playbook useage
          # Note: variable 'per_host' must be 'false' so that the artifacts
          # work within AWX / Ansible Automation Platform.
        - name: Create Automation Artifact
          ansible.builtin.set_stats:
            data:
              nfc_automation: "{{ nfc_automation }}"
              nfc_tasks: "{{ nfc_tasks }}"
            per_host: false
          tags:
            - always


          # Final error check to fail the entire play run on error 
        - name: Error Check
          ansible.builtin.assert:
            that:
              - nfc_task.error | int == 0
            msg: Error occured, Fail the play run
          tags:
            - always


  vars:

    nfc_pb_awx_tower_template:

      - name: "SSH Server Configure"
        ask_credential_on_launch: true
        ask_inventory_on_launch: true
        ask_tags_on_launch: true
        ask_variables_on_launch: true
        description: |
          Configure SSH from Inventory
          Available tags:
            'check' Check the Host SSH Certificate,
            'configure' Configure OpenSSH,
            'install' Install and Configure OpenSSH,
            'renew' Renew the SSH Keys.
          If no tag is specified, all tasks will run if the applicable variables are set.
        execution_environment: "No Fuss Computing EE"
        job_tags: check,configure,install,renew
        job_type: "run"
        labels:
          - configure
          - install
          - openssh
          - renew
          - sign
          - ssh
        use_fact_cache: true
        survey_enabled: false
        credential_types:
          - name: role/nfc_ssh/host_ca_signing_key
            description: A Credential type for No Fuss Computings nfc_ssh role
            inputs: |
              fields:
                - id: ca_public_key
                  type: string
                  label: Host Certificate Authority Public Key
                  secret: false
                  multiline: true
                - id: ca_signing_key
                  type: string
                  label: Host Certificate Authority Signing Key
                  secret: true
                  multiline: true
                - id: password
                  type: string
                  label: Key Decryption Password
                  secret: true
              required:
                - ca_public_key
                - ca_signing_key
            injectors: >
              file:
                template: '{{ ca_signing_key }}'
              extra_vars:
                nfc_ssh_path_host_ca_key: '{{ tower.filename }}'
                nfc_ssh_host_ca_public_key: '{{ ca_public_key }}'
                nfc_ssh_host_ca_decryption_key:  '{{ password | default("") }}'

          - name: role/nfc_ssh/nfc_ssh_user_ca_public_key
            description: A Credential type for No Fuss Computings nfc_ssh role
            inputs: |
              fields:
                - id: ca_public_key
                  type: string
                  label: SSH User Certificate Authority Public Key
                  secret: false
                  multiline: true
              required:
                - ca_public_key
            injectors: >
              extra_vars:
                nfc_ssh_user_ca_public_key: '{{ ca_public_key }}'