From 42ea1e2d03b55e1e0d6604fe04300e824b79d811 Mon Sep 17 00:00:00 2001 From: Ryan Blundon Date: Sat, 14 Mar 2026 22:15:28 -0500 Subject: [PATCH] deploy step --- ansible/group_vars/all/vault | 399 +++++++++--------- ansible/host_vars/turnstile/vars | 25 ++ ansible/playbooks/deploy_step_ca.yml | 29 ++ .../playbooks/roles/step-ca/defaults/main.yml | 20 + .../playbooks/roles/step-ca/handlers/main.yml | 7 + .../playbooks/roles/step-ca/tasks/main.yml | 84 ++++ .../roles/step-ca/templates/compose.yaml.j2 | 24 ++ .../playbooks/roles/step-ca/templates/env.j2 | 4 + boilerplates/step-ca/.gitkeep | 0 boilerplates/traefik/dynamic/step-ca.yml | 22 + .../proxmox/hosts/tfvars/turnstile.tfvars | 25 ++ 11 files changed, 446 insertions(+), 193 deletions(-) create mode 100644 ansible/host_vars/turnstile/vars create mode 100644 ansible/playbooks/deploy_step_ca.yml create mode 100644 ansible/playbooks/roles/step-ca/defaults/main.yml create mode 100644 ansible/playbooks/roles/step-ca/handlers/main.yml create mode 100644 ansible/playbooks/roles/step-ca/tasks/main.yml create mode 100644 ansible/playbooks/roles/step-ca/templates/compose.yaml.j2 create mode 100644 ansible/playbooks/roles/step-ca/templates/env.j2 create mode 100644 boilerplates/step-ca/.gitkeep create mode 100644 boilerplates/traefik/dynamic/step-ca.yml create mode 100644 terraform/proxmox/hosts/tfvars/turnstile.tfvars diff --git a/ansible/group_vars/all/vault b/ansible/group_vars/all/vault index 89f3a1a..367f129 100644 --- a/ansible/group_vars/all/vault +++ b/ansible/group_vars/all/vault @@ -1,194 +1,207 @@ $ANSIBLE_VAULT;1.1;AES256 -37643934663536616237303639323934346232336238336163376663316432383061326431646164 -3836336631623533363261373533306539336432396633380a306263623835363265646561376336 -62623964396664636230313938643531366262383636303835383332373831613065653834373064 -6263643636326132320a653863663631313531646365386363376634633765643231303132323437 -63333638363439346638626564373939336331333466373438333363396664613937373562353234 -32633066663832373938666162396336306538313733643730363435346562653662396437393431 -39353866663636326662343465623763363165623065623139666637386638313533633961353330 -31353131623135613832363431396163373734396138366465323164643539393661623166623130 -33353037396637653432623061653262343138663837613462323265336138623236666633363132 -35316537663338313537636262623838613539653863636237393832353536353935633831353337 -37613663653831313534333065323666633863646466323463393137353732343034313833383738 -33303835373634313765383734393532616131336638636562326330636335376333633636326664 -61633764633130316566323338353734636230623638373731386237663733396535393037623961 -63396539326162383935323964363033663164343936346233653131613738326263636135626433 -64616436633430376461306637653462393339356631313964323161623931633937663932386262 -34343337353136633033656461396239633465373330373439316266303632666364383935316462 -65326234623639366662323866636435303664613163383163633638323535323362646431363465 -39366639373530313934336433363137333436643664363031363938663533386437393564613038 -64303264306166616233386463303638366665366136646539393236333832663835343237663030 -65346630613034333736336335623663303139326534336334356238316430393130346162313739 -61653435333634613233616431363231646562393635636235636331323839363735373763633064 -61616663616662323263383231323738346339356164323361613261643138366463393562376666 -37343864393632373434313839363265383439316562376265663139353361306438306630623532 -34383066383331346438633930326164396365633031633164306633363264353739316165303765 -37663535343130656137376565343933613964363637333131623630383364316166633538356436 -31653961363931373931323265656534343532323138303933363161613762383038306538323934 -33336536313264393863393131333639376435393234376665326130353233313365303638643132 -32386634653961373361663365396232306335663336333938666135393866343437613539393130 -36343264616633313565363236323931323736343030353532646137316535303530626564343837 -63393166313063633632303435323963373733646530333265643930613639633661376638376331 -30313038366137653836376636663936636462653163343231636665623366656132613064613238 -63376636383362326339343132363165386230366139613937643666303765356437393265633937 -33363430363564383636623537366464313363616430363232353461666466633339336163653162 -38393561646131323834366638373630333563313232346662363830636539383463356539646139 -62333231643739613063353762373132303036333136383163623764666332643931316264663833 -61373934633834353430353763643830386438633637333561323038373839336364636133663433 -34373136343463376463356435326364336334386436616438396466323537636162313934616662 -38353939633630346261613231316461353632623733633730333833386365396634303039346430 -34633662346565313133313161353937663233376435393730373465323233643133643662316463 -64323930663462316166386661623537383861303532646662303037323166363161303462346264 -32653330303733303430313233396435666131366334373266356535636361666532303536666563 -62316434613863373534643633323537633733633534643533633939663063356564383336646337 -62363865386362666138663464383632653537313766616661316231326466636330383635613530 -38633533306265356162353465376439326134346566316464393564373261303566623139313531 -33326464316265353336613939623761316161393163393333656664326166316232323537353065 -38656535373236653266396564613362623131633461356230303033356563366330366530333263 -33663531623733373561666538626566393034323030653236663661306536626231346564613331 -66373736663362373962646463663831313033356535626131633565343735366536323232383166 -62643236623461636339366631333438313830633631616539343166663138366236366564623637 -31656236326539336331623437656636373263373364373561646265653133336336313937353438 -32343635646362653237333036306665373037323663383532393162383365336462373930663235 -64376237333934356239313062326665373932356539623534363562333264383066333932386435 -66376162343832613663303836363933636662643564646235633262643234623536363264383265 -64313563353066636533626138343131623165326234363161333735646537376532633563656466 -38663933353833653563353537643933366534366138346565353136343262653162643762363537 -33353363326533306661656466386637353337303531313036333539623537306330346138623962 -64626230383766626335383462303832376434663237303962636538393661623861343164333837 -63303466313733626134383236613764356338333566313033346633626439656137373430393432 -64323634656331636234373563613066396565306332616537623537613462646161333433653736 -36393337313937666631303663633362396432623162326537363935366230646361346639356130 -65333639373237393065336235646162303636313736616366663531333134336339356533316237 -62316236373534313061316135663938633962373265333165333438633063303535326634366362 -63366631336265313331653761336562353933343930336331303134326135646531306333353064 -37613036656164643038393339613862393031656564666266633137646336323036336532363866 -36363765396563376463393561333666653432303861343163313839303031363933396361343636 -66613862373439393030623232653062633031306133323666633738646639646433303266393137 -32636233633964633937663132346533376130373139626233633466356632323934316131343836 -65636631396236386464336263666238376330626665343833356539623263323861613566366131 -63386532633534356236623738326639656238666430373439346264306164646432313065656366 -37663035643932626230396565346436633137633561636263616265366162383036643561346661 -36343738353039396466346434633762653164663734396161366466616133626330373962373336 -61326336393538316363353334316232333933313639326363623432393136363135653635303635 -63333464646166313066636334656362356330336236346363616566613262333730383034626163 -30323161316365656135383032616238633263336632313537663938366236633561666138336563 -62616335343733613831343762336639333361356439623039316234343530396463633638633263 -39623764623239653839343930636337356366356130343263366462363136633535613037313833 -62396237663930346563626431376137323161656332373566393865343735313064363832393631 -38393238376434303034343361393361643266646335316138666433616132343137346633636436 -35393830383731303736373332376266356466326534366136303766343262363931396530646637 -64643938353066643337376231623132333835363437353033363939653237393733653662356633 -37303033666238313965666335376139666261626539383333313665666530633832663765336262 -62613565626639656630663836383134333436326361613630353037306561633262616463623862 -63396636323633356431306663336436346136666266363632343338363738653564666436386137 -35373363646663663564643162326639646564346564616430633832643661366664393639396664 -38613139303032343336373366386235313133643033373132333739633131373563613837303765 -64313139356638353266656136613263663739383134373964373832316334663661356566646465 -65343763383663343134633030613039346330666236346363633234616132326465333236326233 -34303262613834623362613232626463326636383163346430346564353833363230313633316437 -66333239616162633033306237643362316564613839383461306261636161393931373862393365 -31626239633439303166343935363638353537646437613962323437613737646465366136633633 -31623731633733366363336330623865616664383964613037663132356638653363353939363735 -37383136326465323633366432613034653532616635373130636465653837363763316530643136 -62633434323436303636343037383463643565613365396361316365643936383938623730303362 -61366365623336393834383734346330313737393631323632323631306563623163613862363837 -62376161313739323933663836303439646661306632613861306430373133613866353431393238 -38643762613936666164336231623532363666323438636163663639616337303032313265333738 -31343330343539316130616266383364383463303861623933306631343738383033666461343536 -62376630363264383061353531663033376134313262643739346531386639653739383535646337 -37396662366135643264653562663031303738643833306139383538333565616531663538346536 -31326462353734643065373765646332653464336237333761643833656136613838363162393264 -30333537363435313566613636393764393363646364613632653430313632343130303534313237 -66336262663238326662653834316163396666636133383632326362646533303736393835666461 -61376638343935353636313335323037353965356633633638333562363731366232613838313966 -31633762653630313364303764333638316635646138343335326537333936353233343232613939 -37613533313863323034623336343230633833333036313034376362353334373565633164346430 -35346361643630656133386438326631393837356136396334643361333266393762343034353934 -38636362363762333239613638313538656636653237656636613438333134666535663365393934 -66303564363330343664383739353563636537346638353635656132363465353237326133333533 -32363736623866656537353962333435613261633838333661353832646264336466386130623733 -34393932613032613439666336633066306261653130383065333863333663646465613762663930 -33316366386463656130373238366531376337383434363965393431633766616430383631633331 -30373662623639616463643962383365373763653139613232656533336338656461343362383931 -31663966646236313630636539656266373531323764356166393137336234616634373730346466 -31636330383866343633386162663632353433313065363335333965623065336237646538316533 -39393132313462356135633166613164313565303161303130353532383231613561623965376135 -63653236626263626266633532383161346633336162663263613034653166366461386365633839 -34633134363836346435303937363330613135633861626436666132306636363334313032353739 -64613138303833613462643363656435303537343665666634313031343331623836663262386633 -66613632656439656664343535353632653963333464323930646266666137363962306263663463 -30663136346435663062373765656234373265393936333438316461333466633531663862623363 -39656430656536353339646139623932636365653861363231613934336464333934323334376331 -64316438646235616361663838356165613734363838303662616439626137326135373531316166 -65643964303132653433643634313764393230373965636164376636353166643364373732383935 -32343865366461313537393961346333613234613834366237313064303930316633303765623064 -32303737363363336230653831613738333665613163646539613935623730666132613934626531 -31626666636538343862393434303032663135363861313532656334643439313162623830346233 -30636432616535616331366637383265373339663365316430326430383036333535666635323338 -66613065663666323864306431396364333637323166306634383864666533613839653132303132 -32616435646236646563663062303237313064643466326363343431633332346166656134366632 -63636165653163363063323838366666653439653565353162336232363031363762323861633665 -61313933326161386430393632383764303235353537616637346139373031643334383134326136 -65386237353538323336656238643938353132373961333462316463333037383931353966613730 -63326561616133313236326132366331653837623164623336656161623834653261616562323335 -65663034666164323961383565373732336430373931646533333063353461346233363263343638 -66366162623135373739346566643939333466346336323034373637623739326634366633313734 -66313130613734313066323363376363396630643063336166666563383530323466333435386337 -35383135396639623364373232626434646336353031363036323865323730366162633334343236 -34333563656134666162363465333865303966656633663862636230386461646562353732363830 -66323164356432386361333332633934613539363334333239643662626162646139376638623037 -36636362396435303762366365396465393231396631636133623236326133336235633865643439 -33373665356266333263333130366230393430323265653433666138383562623561623239633264 -37383337353030343531383565316562643933336233306136306564323838663338643439613030 -63616561366332356536643364393961323935373732373236316339313361323531363034323339 -35326535653962376436663136653139376639333535323962303265633563656130366561343432 -64663366343865303064636562303532333533626539633334306234666261646632666637626636 -36623966636464633337666231343735343862623337383831323765396531396235306638643435 -31313035373966363433383431373734323536353731646539656631356438393538623637613563 -33306166306531343136316261333465376564353732623662356530386339316565393339616534 -36353065343933386630313661353331366333313663353266353435646430363335626230663537 -62613063396334623935353639336136313231373830653565626333666337323161636333393263 -36313132316230656364323139346231323734303538396239356230346563653632653766376237 -33616563363139386163366565323532383863353132356139636138626161626331633763623562 -38306163633538316533366139646433363763333835653235653164386636643136396130323362 -36633432333538383762623339623631653266333536313762343661386537313034633630353733 -37663466613265326639393261386436643036386261316337353330303034303539373362616238 -33316635373166366633363537646136396333393434663430383532636561346632353831313761 -32666430623538396431366464613930353539366530616439363664343439623961613431393437 -65306466346161666131303938386132663364663866333037623639366139363131636261386230 -65333338383364663732333235346636653236383265653061616236343236613337356434303936 -63666335633735323962636235326437353736326563386231616638343962366337353831613831 -30643239396536666462393562393466636238306439396161653637303361343463626331616331 -62353838366330666338356432313834303737653833633337666635633166633537336338313739 -31653464626331656438663461356166363739636430353061356162656361336366353464353866 -63363535313635626530356538366663336461353566363966353965643231626136386631616437 -37636135333931316239303562393834323834643265323463613666373434653734656463333633 -39323466646132333463643566613531346563656430316238333933663633313230313866383239 -33383932393235616331613032373031393430333938623238613333613736386563373561386639 -34303661373964353832653431626536396465626361646365316632616363613338656132376634 -61656435623139363565653530323161616134396539653965393634393237643830663763663138 -33623730366132313163653537363936653530373665656464303839656163643864363064656566 -62333363613537643234303237656139333431666261646530643562666538653434373130666135 -35646133373033323634306236323265623130323364613365376436636564376464313562323563 -35373134303333323661353430323535613965623938303839373833313464353035373936363339 -65343230373137333938666133393666626137623434376463663832323337306432323237633163 -30356338393338333664313033646331663834336338623934383636306530323735643230656139 -39396631313563613832343134313263316537643363623836643739663763306137623634653230 -30343436383163336165313764373637633366366332303537616137646564366531653961386630 -34366438663632383166613935313337633133356430613665396339393135393961373963386431 -62393333626366383463316463343662346266343630373330316465633434343834626431313731 -33373964303962353132346631323038666535636666353132653765393937333435313732313834 -39613138363362363964353465333432653735653262303863303733653063646533396531366162 -37333133623466326438383964393561653463356137623133303130333666666437386561656463 -64353835643762623233343364353366653236373063353232393966313130316630613432653134 -62633465623335373861633439353931653530333436333031356338393632656661343237663763 -36346166653662303366633032623461333135313465636430303838396435643238393637643834 -62393831663261353961356261663834623435613861383336336365623739386364323063636131 -36613530613036383562393266323861336131376362383332303766613732316563636165643661 -33336564376464653063366338633739346466363966386561633431663466313066366264393532 -38393963313064663537393361343062363632343431643262363431643465633963333836666666 -63386239393139613435623330616361303966666138383733303639313539366661386161393030 -38653264333033323830626632636562636132336131666535333663396163303039386530653034 -32346230626264653462353366616263353735663961633466633630373263623834343533666338 -36323035303834393438373530336262633364356137356237363430373638343633 +61396632356133313461646463343234376438306463333931386136366534633166353766393731 +3861336364626264653532626365393661313164323063370a353630666335313032636431383531 +35643232376537383131383863323639353939623433613232643138393863666262353261343633 +6130636437666531650a383637306363636634303733303837323738613733623566306137346333 +38313536376330663164356439306662353036383933653433616165396536616630383339353938 +61326563303465373535306163663632393538663265333138383030633533396537626631646663 +34353366343636303363343864306136613161386632663266356438646666393465626139316439 +66373563623432666536633666303935336530376563383533316233393134396334663438363631 +66386136633937323835653563393663343934343236623464643064363432663439326138306365 +38363732363438376630646633393065366434653631316332383563343737333962303064303234 +34396534373032373463346631633737623664363864343361633030633137653262656139636564 +35643864333663393662323361313133383632623261653036356439326436343363633765353438 +65396465386632393461646238323866313964326531326434323137353434353534383230623161 +38366132396330346636343262666236646339343435343438396665653964396334653933306132 +63656435613265656535663363653335383637386235633335623935623362633363616539666139 +30653338316263393163313464323565633964396465656662326266363734363761396433353535 +63346334616664356433316638306433333361336366613361383637376636383936636361363237 +32613839353934636132346162663861626564383765613837336239373436376562653732626432 +33333963396365626137366635313462303962356164346438356166353866666563653237626139 +35623334363335653733326463626533346165386461343231633364613464653136336433333734 +38353163653138356130366665653338663832343336363163383736613730313865353238656237 +66313935323966646464373235653063653139373565313864383835626535366634333066373139 +30383764363565323264613063306564343363303234333836383131663966613730313766663131 +63653365343230366436626134653864316261396365613430346235363965653666653631646365 +39383436346561323363646363666664303935356661366665353230383436386433313264353331 +31353737666338386635666431663966333564333563383437616537663833373763356266336632 +30643662643732356132306163616131643237326132353066653163653339666435633839393639 +33386133666434356362393834316630633765353736306537346435613838373139393632326433 +62353863663530613065313065393038323039333939656138626436356162636639343764343337 +61363438623361613337653465616435366662303632633865393731303735323337386464376235 +62653738363933353763356363313266643937646439636236623665633430313934306130653734 +62663933373930306436613761393737323862656639383865323133656631356331333930366564 +39303733636365373662373038393133313862636536643132316637393137393834323830663064 +35653635346433633333613233373338383363646631663238313337316637313662323735376362 +35346430366331643366656261366635363461316233653664653065326437666332616466373633 +38336662326563666462663737613834376534656136643764393234386133386165336462616161 +63366432323238303038303333663761656437356561343430396136393066343465613934643361 +32346566313466363161633564656439646635303737613463666335396239316365613962366366 +30303236643338646231336561663431633034323136653236353339613336653335323261326336 +63383364343336333833383063353631396662373062643931363762346365613965623739346366 +62353938636636326539616363656563353064363934323962373564303535626566383031643965 +36316538666337656130643461636561303031656536326563356334356532316130623939643732 +37326532633631396338643763373835396665376330376539656464643530396639366330646330 +65623862323839383364616432383736623061363836376363356266363563313763613863613538 +65393962633965323932663331326532323137366433363432356332396531656130376663323766 +33336436353637306131393861623462306463346138333330326565343666623138663439383038 +65313063353834393433353837393165386334636164373834663730626537626630623866353664 +62636530343731353064336436343465363566656231313765393635303664666365376661323935 +30323233366362393736316432353432646166343261363631353161313033623931353561656633 +63613764396161386336363065366432393730353764623438663364396461353065393432376636 +37616334376338376265353064636333393464303066333231616138333466616261643537353431 +39353031366435303132363938613161326663646664643838313165326133316165663662363730 +38646230366366366464383861383137366136396565626637383134326330646661366466636664 +35376637653665636238383062626562656536326637346239306434626437393161333463373363 +39663732323339353232616535633130633462313764353930353765613634393331363363613038 +66323930393536333662326462653831353732643466333732626532333163633266376631306137 +37613239373865633864383436373861326439323136616439353464666435386561313365656466 +65366336643930646639663362333264386264643461376461656266653263326262313635613639 +39623436643735643361393339643237346530633766373939656562363161396636373434336264 +33393636633035353434383361616436636434356331326635366538313461383933313932336239 +63396236626634653136393265636232623136626563353265386261353562353432326364326566 +33653533656462393966303663646466366431313831343631333734343731363838633037363231 +30363233316530633162356230393732643337353436383335393732366665306432393731303438 +30626633313336633439333136326566326333643261346236376666326336373164356266323061 +66616535333233383636396534346562656436663266646466613764653566353861326232633033 +33366637643137343038333734613361363362356165656631626636663137623237356330376237 +63633738373832393939383265343834313431633966646534343730376339353032653230353530 +38373665656634316537363261366137313638346439626636653339626564636138316432323062 +34393533623639383235663361373431386335326530313663316330666330383437323030663438 +31326532346135313335313137313233643965373536316531386665306639656239383364613430 +63386139623133393966336465646362376662633834626464313834663865613234353863356264 +38343138303331306538303333383238316363333938356162656535396237396262313233613862 +36636231666433626132333235386163303338373831356139353464393234333365616561336437 +61303133633135653930643861373537656438316364376637306430363461623064646261313032 +32376465653838393533666631376431306435636364393462333138623732653633306361653765 +30633631396430616232643339323966383037356433323136633266663132623937366363613936 +66643531623234343761313833633066646133316663646533643335323139306537346532313630 +38323065333938656531633165663063346335303236666461336438343033323166316138373766 +63313066383136323461373934326162343538316136346537313135373337653764326665633662 +36376234633562643965396363613366666432386238363536663730343532636638623665393263 +61396664393866656434616139663163333239346531646636613637393866633665656435363733 +38313761343566363464613539636465326564333963626433616366663762643537613633323638 +31343232343462613861303964633564316362336135303630383366353364633538323233306538 +36333436663562336134643361326131343565356436613064313237383131646562613865383632 +34393663383736633565653965616534376338346337656530306132323233383330383937626537 +30666636396633376363643466613163643432613332373732313264316161346166636131363930 +31343962313338663338373463613464343830353432323835323736656131303665353262326634 +31306632653737356562613664666636663937623430626664653333313331646236396563663965 +33303962333466376362346534316630373161393430643062373431623233663065353434346162 +34343465383435653335613834633261613064393835356565373138633638313832616138373065 +64323763383438653036323537393162633237303334393730353664326166343963363232336637 +61316631373562376332323933616334646139356161336265386332653435626537393163363936 +65613931626366303739366338343531646334626365303836636536343634323030386564396433 +62376565386131653135346634633663303961643335656235663632646434663739346433663465 +65393063376239393233663266666530313561383433616466303965303230643766386336663130 +66663132343531653432393466656634373232323938616633363261366564326664633461613566 +35633263666639353366303031353533386163613333343862326231306639323861353139666630 +30373630376336383365656633313037376233303638333935373663353030366466343564393062 +35646135343732323630353032636336393433623135376364343232316264653738323764303663 +37316231613465623461613832333466316361363436346565663662316366613336343339346130 +35373935633437646135323163386532633634313766626432623931666539383432383263346566 +33323938353463633766313964623463626635623935613234326535386266396665336462333163 +37316161343030383633376531386266643862646535623337316536393535383238376330303562 +31313163623134623430613266376635356534393535323639636465613766666339663634646563 +32613031303931373164663238343361363465613464666639306461633433636230383834666262 +31616565663538636539393431363634393061396465336462646562393837323531623934356139 +65633735363935376236663532623037333531393463663165316437653033356430353733653462 +66323038343163643537663738353336616234306534396433376233666436396236643732383631 +35613937376430376662663439666539303235373264653639336362663064653632366230336463 +34613330616362666232653665306532366461313133303866313933353433636561613036313734 +64316431633162636639623839313239326232396462333134333439316661663363386539623132 +31336638346561313866366331306164363737613736343634366330663434393538623962363035 +62396239386133336262343130333632313766613039633961373232393766306464623361633038 +61386635656461303132393430346531383362383638393232363261623862636261306266326235 +32363465336332363237643836363630316337643533373534376666363737343566643765333764 +34336635656661663238323131356162343530323364326632343732666431623566386331343739 +33353831376135343835373636656464363637373736656330303836333237646434623763343532 +63353537633039383165613438616364613136393132356435346436646662656334633961346335 +65373533346537663434373731613131306639356565383365306436393631303038633937623464 +39376232356439336136663131613663316134353031666130653338323465383863306535316131 +37363763656237323164366235323434346463333363633034326566326634626337393463373938 +32366636306230363037356636646561343663316561363339646137316437366265306164306638 +32663135353832636336653539316534356530303538643739393737343832343636353535363331 +64396266363837366130326231383762313932636538383565656437313133616437383464663366 +66623532306362303736666433663038393832623037346230373530396564666666353935636137 +32636537356663363836393761633861323962343164636438396665303931353337316534366262 +61376136396635636435333361623336616632653834356236633136373234383538393662663730 +38373038666161316162396634313133333164353430646662663637656135346131383766636432 +63313737646262633437313333326638383561353131373766393966656135303461386164336265 +30343630646334393566333864313136313130636534336139646333323963316132346166373239 +33376566636231316266333039653363646262366334333132653839316232623937353066663036 +65653465393162373931613438396435303335306537613734363963373764336566636233363763 +65623638643965383836636166356431353534363632363034353262663264623836336630353132 +36653938613130633435396534613532396365646333353634646666383738666163343838643230 +32333236646535376665343465623730373637363964383436616439343839393034313365656536 +61306366396430383465366330666662373035386333636237303632383034373439653765663364 +64333163313263363664306630353061326461643532353661613865363666366132333366383863 +38356463303762336139626335333664623331333530663034663731303336316264623235616463 +34616430366333303766633566616331386136626438383433613038333932373232353338633935 +63316132316139363735346634376236653665666334613736643731386562306166336161353230 +66626564333930316236346537363630336463363031323237336636343237653266393638383435 +63326337396532373461663130653362653364366337396639303330656661623933303762323937 +38336437303439363636383730343162323938363266326264386439363537366532376562383266 +38346534343539616465616166353661626163356164376633373663616466303632626231396336 +30633439666532343563313833636338333461353839323637623034333434356330646332313638 +64666366353762663166306163346237363737633365656463616261353934633335373731373338 +65613965666236383831633862633865393763613337366336393934316639353064643936663161 +65643661316135653234653937333566376439313764323662613037393366333464633063386532 +64323465303939306332623964343963386432323338623132666633303634316365363635663262 +37643961653330373035656566376564313234333538663934666333343931623130613261306565 +35396237353837623737313730396435343966636237386337666438313864623961366333626136 +61373131333135393665653962333237333363343462656464326165346430353838333632303830 +31613434653238636665346163363333653463353433623134393864643437616339633334316537 +62656137356564323934303162323466616262373461633863333432333233376163356638393065 +38663537366333653837396463313233623164633839653534383866396265626264306161363038 +63313132306165653730376430336638356539636665353530376633613730373061303566373637 +37303138303832373433333363316664613532363034333564353136393966663066356339376532 +33636338353364646234666434316265393036613935346333646632333835646132303235376166 +32623631623834663965613331363837383764393837623535323237306637653235383739663863 +39323461323266356433306562643431636566643032393265623961313132366334313635373666 +33613435393063633432666365643662616534663638663538633338633638653738313466336664 +65373261643731623966346563326464616439383137326366643463663732663436303732633862 +32626331643865313935366530646633666135663638633664306436643566623131663236323133 +33643039656261383561373032646464356336383864363935646233663832363065633235343261 +36396534393135303334333661383336646561636232373663636230656233333963376138396466 +33386463393038396663393161333534373065336464306134656436383036343030373964666533 +39323238353833383137363431333165313366363336626636316663353361653330663663363335 +30366635363765306236636338663836636537363866383264656563316535643461663336393535 +33366564363636613564303934366366366162313838653235373639643166633361333434313339 +34336630363331373335633333343637376438653662336636323931666635333765376133353163 +34373535346636356564653038333965326237666133353633633462633265316637363737663266 +32613734393634393361623564316361646564373339363035346339646462633736663337663930 +39623538643630373338636564376264353535626533346366383831646666643233333963373232 +38616166363964353135346438613233333131386165653030303435346263396433353162623861 +31313561656538633765333362323732363666316562663664396239616132356531623334363939 +65373663386135613939316631376536656332363436373936306230323966306231306332343938 +62663961363266353161313337306236643832393465646661333635356537363732396431333666 +30396165633138653436663762383738303263333864643136383866623866383165636430643564 +32363033313361623431316632396135346236613133643535353964616133663634636337383933 +30333532336635633034363335666537653237613937386538626263306166356332613438343765 +38653837326664343064373835343432376663616133326566306562343930393439366365373437 +33343462366438363139333938643064663536323862663939613262306361363966383834316632 +31666363626135353734353533376365356464306262613664643030326539366434663438316661 +62393835353738313465333036346637633134663665643164363335643938333432353930326666 +65636664316231393430373162373830396365313131376236666266396333656235623764343737 +61653232646633656135666633396263306434303738306662613264336265646331373937333231 +31383239646634623439633435653939633132613465336333336533396439353434333366353231 +66323039383561666364633962646138333230643334616634313230336563633336323463613065 +66633535633138663065313138326433303063363237613732373363643262313838326133393237 +64663364316531323831313363643463306261336362366362623030333630376131333864363063 +34636233633737346233636562623930316564633136396365356161656231623837643166393765 +31326330313530343466363066613131623437363366383866313735333932356531643966643765 +34333531633364666564306131623739343731393436373333393431613464306266383765373139 +37343234636665396162616339316665356334383361373736646534323565363333626661653533 +34626430356437383635353034623466353332353533313537386165336461336263363937343230 +31333461313235623635623833636133333166383430653336313961613130373764656336653366 +33333361343936646333323866383966636461386439366663373762393933376565666236383136 +62386265646430663131333037333539313065633434626130623361333833616139383539646639 +61363034303131323935626537353066363936643161323236336331393837393932643231633138 +61643061346465303233666261393265626466393563656361303935353364393062363038386635 +31333561303763363766623532303536383632663565363761656232366630323035336638386263 +32376365323330616533326533626261636532653764386236383766623236333830343535623435 +63333432373239343232633161343335663839303962396238346564363936323062393135356539 +35666135346636326135363834316162313063663239346134303438346337396562636538333935 +64333735666666316133303636623531626666663738343765363831646237616666396431396535 +6637353236393330613135623337333432303432313238633634 diff --git a/ansible/host_vars/turnstile/vars b/ansible/host_vars/turnstile/vars new file mode 100644 index 0000000..725ecd4 --- /dev/null +++ b/ansible/host_vars/turnstile/vars @@ -0,0 +1,25 @@ +--- +# file: host_vars/turnstile/vars +# turnstile — Smallstep step-ca SSH Certificate Authority +# VM provisioned by Terraform (pre-pipeline bootstrap) + +# ─── Network ───────────────────────────────────────────────────────────────── +ip_address: 10.1.71.34 + +# ─── Application ───────────────────────────────────────────────────────────── +app_role: ssh_certificate_authority +app_name: step-ca +app_deployment: docker_compose + +# ─── step-ca Configuration ─────────────────────────────────────────────────── +stepca_hostname: turnstile.local.mk-labs.cloud +stepca_dns_names: "turnstile.local.mk-labs.cloud,10.1.71.34" +stepca_ssh_enabled: true +stepca_listen_port: 9000 + +# ─── OIDC Provisioner (Authentik) ──────────────────────────────────────────── +# Client ID and secret stored in vault +stepca_oidc_provisioner_name: authentik +stepca_oidc_configuration_endpoint: "https://authentik.local.mk-labs.cloud/application/o/step-ca/.well-known/openid-configuration" +stepca_oidc_listen_address: ":10000" +stepca_oidc_domain: "local.mk-labs.cloud" diff --git a/ansible/playbooks/deploy_step_ca.yml b/ansible/playbooks/deploy_step_ca.yml new file mode 100644 index 0000000..cddf7c4 --- /dev/null +++ b/ansible/playbooks/deploy_step_ca.yml @@ -0,0 +1,29 @@ +--- +# ------------------------------------------------------------------------------ +# FILE: playbooks/deploy_step_ca.yml +# DESCRIPTION: Deploys Smallstep step-ca SSH Certificate Authority on turnstile. +# Installs Docker and configures step-ca with SSH certificate support. +# +# PREREQUISITES: +# - VM provisioned via Terraform +# - DNS record for turnstile.local.mk-labs.cloud on monorail +# - Authentik OIDC application created (for post-init provisioner setup) +# +# USAGE: +# ansible-playbook -i inventory.yml playbooks/deploy_step_ca.yml +# +# POST-DEPLOY: +# 1. Note the CA fingerprint from the init output +# 2. Add the OIDC provisioner (see docs/guides/step-ca-setup.md) +# 3. Deploy Traefik route via update_traefik_routes.yml +# 4. Bootstrap client workstations with: step ca bootstrap +# ------------------------------------------------------------------------------ + +- name: Deploy step-ca SSH Certificate Authority + hosts: step_ca_server + become: true + + roles: + - common + - docker-host + - step-ca diff --git a/ansible/playbooks/roles/step-ca/defaults/main.yml b/ansible/playbooks/roles/step-ca/defaults/main.yml new file mode 100644 index 0000000..0c5f7ee --- /dev/null +++ b/ansible/playbooks/roles/step-ca/defaults/main.yml @@ -0,0 +1,20 @@ +--- +# file: roles/step-ca/defaults/main.yml + +# Docker image +stepca_image: "smallstep/step-ca" +stepca_image_tag: "latest" +stepca_container_name: "step-ca" + +# Paths +stepca_base_dir: "/opt/docker/step-ca" +stepca_data_dir: "{{ stepca_base_dir }}/data" + +# CA configuration +stepca_ca_name: "mk-labs CA" +stepca_listen_port: 9000 +stepca_ssh_enabled: true +stepca_remote_management: true + +# Network +stepca_docker_network: "proxy" diff --git a/ansible/playbooks/roles/step-ca/handlers/main.yml b/ansible/playbooks/roles/step-ca/handlers/main.yml new file mode 100644 index 0000000..d17b3c8 --- /dev/null +++ b/ansible/playbooks/roles/step-ca/handlers/main.yml @@ -0,0 +1,7 @@ +--- +# file: roles/step-ca/handlers/main.yml + +- name: restart step-ca + community.docker.docker_compose_v2: + project_src: "{{ stepca_base_dir }}" + state: restarted diff --git a/ansible/playbooks/roles/step-ca/tasks/main.yml b/ansible/playbooks/roles/step-ca/tasks/main.yml new file mode 100644 index 0000000..39ba76a --- /dev/null +++ b/ansible/playbooks/roles/step-ca/tasks/main.yml @@ -0,0 +1,84 @@ +--- +# file: roles/step-ca/tasks/main.yml + +- name: Create step-ca directories + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: root + group: root + mode: "0755" + loop: + - "{{ stepca_base_dir }}" + - "{{ stepca_data_dir }}" + +- name: Create Docker network for step-ca + community.docker.docker_network: + name: "{{ stepca_docker_network }}" + state: present + +- name: Deploy step-ca compose file + ansible.builtin.template: + src: compose.yaml.j2 + dest: "{{ stepca_base_dir }}/compose.yaml" + owner: root + group: root + mode: "0644" + notify: restart step-ca + +- name: Deploy step-ca environment file + ansible.builtin.template: + src: env.j2 + dest: "{{ stepca_base_dir }}/.env" + owner: root + group: root + mode: "0600" + no_log: true + notify: restart step-ca + +- name: Check if step-ca is already initialized + ansible.builtin.stat: + path: "{{ stepca_data_dir }}/config/ca.json" + register: stepca_config + +- name: Initialize step-ca (first run only) + when: not stepca_config.stat.exists + block: + - name: Run step-ca initialization + community.docker.docker_container: + name: "{{ stepca_container_name }}-init" + image: "{{ stepca_image }}:{{ stepca_image_tag }}" + command: >- + step ca init + --name "{{ stepca_ca_name }}" + --dns "{{ stepca_dns_names }}" + --address ":{{ stepca_listen_port }}" + --provisioner "admin" + --password-file /home/step/secrets/password + --ssh + --remote-management + volumes: + - "{{ stepca_data_dir }}:/home/step" + state: started + detach: false + cleanup: true + register: stepca_init + + - name: Display CA fingerprint + ansible.builtin.debug: + msg: "{{ stepca_init.container.Output }}" + when: stepca_init is changed + +- name: Write CA password file + ansible.builtin.copy: + content: "{{ stepca_ca_password }}" + dest: "{{ stepca_data_dir }}/secrets/password" + owner: "1000" + group: "1000" + mode: "0600" + no_log: true + +- name: Start step-ca + community.docker.docker_compose_v2: + project_src: "{{ stepca_base_dir }}" + state: present diff --git a/ansible/playbooks/roles/step-ca/templates/compose.yaml.j2 b/ansible/playbooks/roles/step-ca/templates/compose.yaml.j2 new file mode 100644 index 0000000..184def5 --- /dev/null +++ b/ansible/playbooks/roles/step-ca/templates/compose.yaml.j2 @@ -0,0 +1,24 @@ +--- +# Managed by Ansible — do not edit manually +# Smallstep step-ca — SSH & X.509 Certificate Authority + +services: + step-ca: + image: {{ stepca_image }}:{{ stepca_image_tag }} + container_name: {{ stepca_container_name }} + restart: unless-stopped + ports: + - "{{ stepca_listen_port }}:{{ stepca_listen_port }}" + volumes: + - {{ stepca_data_dir }}:/home/step + environment: + - DOCKER_STEPCA_INIT_NAME={{ stepca_ca_name }} + - DOCKER_STEPCA_INIT_DNS_NAMES={{ stepca_dns_names }} + - DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }} + - DOCKER_STEPCA_INIT_SSH={{ stepca_ssh_enabled | lower }} + networks: + - {{ stepca_docker_network }} + +networks: + {{ stepca_docker_network }}: + external: true diff --git a/ansible/playbooks/roles/step-ca/templates/env.j2 b/ansible/playbooks/roles/step-ca/templates/env.j2 new file mode 100644 index 0000000..3959e4b --- /dev/null +++ b/ansible/playbooks/roles/step-ca/templates/env.j2 @@ -0,0 +1,4 @@ +# Managed by Ansible — do not edit manually +STEPCA_DNS_NAMES={{ stepca_dns_names }} +STEPCA_SSH_ENABLED={{ stepca_ssh_enabled | lower }} +STEPCA_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }} diff --git a/boilerplates/step-ca/.gitkeep b/boilerplates/step-ca/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/boilerplates/traefik/dynamic/step-ca.yml b/boilerplates/traefik/dynamic/step-ca.yml new file mode 100644 index 0000000..7193a5a --- /dev/null +++ b/boilerplates/traefik/dynamic/step-ca.yml @@ -0,0 +1,22 @@ +http: + routers: + step-ca: + rule: "Host(`turnstile.local.mk-labs.cloud`)" + entryPoints: + - websecure + service: step-ca + tls: + certResolver: cloudflare + options: step-ca-mtls + + services: + step-ca: + loadBalancer: + servers: + - url: "https://10.1.71.34:9000" + +tls: + options: + step-ca-mtls: + clientAuth: + clientAuthType: RequestClientCert diff --git a/terraform/proxmox/hosts/tfvars/turnstile.tfvars b/terraform/proxmox/hosts/tfvars/turnstile.tfvars new file mode 100644 index 0000000..047da1c --- /dev/null +++ b/terraform/proxmox/hosts/tfvars/turnstile.tfvars @@ -0,0 +1,25 @@ +# ─── turnstile ─────────────────────────────────────────────────────────────── +# Smallstep step-ca SSH Certificate Authority +# Provisioned manually (pre-pipeline bootstrap) +# +# Apply: +# cd terraform/proxmox/hosts +# terraform apply \ +# -var-file="tfvars/turnstile.tfvars" \ +# -state="states/turnstile.tfstate" \ +# -var="proxmox_api_url=https://main-street-usa.local.mk-labs.cloud:8006" \ +# -var="proxmox_api_token=terraform@pve!terraform-token=" +# turnstile — Smallstep step-ca SSH Certificate Authority +# Provisioned manually (pre-pipeline bootstrap) + +hostname = "turnstile" +vm_id = 71034 +ip_address = "10.1.71.34" +target_node = "fantasyland" +clone_node = "fantasyland" +template_name = "ubuntu-24.04-small" +datastore = "liberty-tree" +vlan_id = 71 +bridge = "vmbr0" +dns_servers = ["10.1.71.1"] +search_domain = "local.mk-labs.cloud"