deploy step

ansible/playbooks/deploy_step_ca.yml

@@ -0,0 +1,29 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_step_ca.yml
+# DESCRIPTION: Deploys Smallstep step-ca SSH Certificate Authority on turnstile.
+#              Installs Docker and configures step-ca with SSH certificate support.
+#
+# PREREQUISITES:
+#   - VM provisioned via Terraform
+#   - DNS record for turnstile.local.mk-labs.cloud on monorail
+#   - Authentik OIDC application created (for post-init provisioner setup)
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_step_ca.yml
+#
+# POST-DEPLOY:
+#   1. Note the CA fingerprint from the init output
+#   2. Add the OIDC provisioner (see docs/guides/step-ca-setup.md)
+#   3. Deploy Traefik route via update_traefik_routes.yml
+#   4. Bootstrap client workstations with: step ca bootstrap
+# ------------------------------------------------------------------------------
+
+- name: Deploy step-ca SSH Certificate Authority
+  hosts: step_ca_server
+  become: true
+
+  roles:
+    - common
+    - docker-host
+    - step-ca

ansible/playbooks/roles/step-ca/defaults/main.yml

@@ -0,0 +1,20 @@
+---
+# file: roles/step-ca/defaults/main.yml
+
+# Docker image
+stepca_image: "smallstep/step-ca"
+stepca_image_tag: "latest"
+stepca_container_name: "step-ca"
+
+# Paths
+stepca_base_dir: "/opt/docker/step-ca"
+stepca_data_dir: "{{ stepca_base_dir }}/data"
+
+# CA configuration
+stepca_ca_name: "mk-labs CA"
+stepca_listen_port: 9000
+stepca_ssh_enabled: true
+stepca_remote_management: true
+
+# Network
+stepca_docker_network: "proxy"

ansible/playbooks/roles/step-ca/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+# file: roles/step-ca/handlers/main.yml
+
+- name: restart step-ca
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: restarted

ansible/playbooks/roles/step-ca/tasks/main.yml

@@ -0,0 +1,84 @@
+---
+# file: roles/step-ca/tasks/main.yml
+
+- name: Create step-ca directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - "{{ stepca_base_dir }}"
+    - "{{ stepca_data_dir }}"
+
+- name: Create Docker network for step-ca
+  community.docker.docker_network:
+    name: "{{ stepca_docker_network }}"
+    state: present
+
+- name: Deploy step-ca compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: "{{ stepca_base_dir }}/compose.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart step-ca
+
+- name: Deploy step-ca environment file
+  ansible.builtin.template:
+    src: env.j2
+    dest: "{{ stepca_base_dir }}/.env"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  notify: restart step-ca
+
+- name: Check if step-ca is already initialized
+  ansible.builtin.stat:
+    path: "{{ stepca_data_dir }}/config/ca.json"
+  register: stepca_config
+
+- name: Initialize step-ca (first run only)
+  when: not stepca_config.stat.exists
+  block:
+    - name: Run step-ca initialization
+      community.docker.docker_container:
+        name: "{{ stepca_container_name }}-init"
+        image: "{{ stepca_image }}:{{ stepca_image_tag }}"
+        command: >-
+          step ca init
+          --name "{{ stepca_ca_name }}"
+          --dns "{{ stepca_dns_names }}"
+          --address ":{{ stepca_listen_port }}"
+          --provisioner "admin"
+          --password-file /home/step/secrets/password
+          --ssh
+          --remote-management
+        volumes:
+          - "{{ stepca_data_dir }}:/home/step"
+        state: started
+        detach: false
+        cleanup: true
+      register: stepca_init
+
+    - name: Display CA fingerprint
+      ansible.builtin.debug:
+        msg: "{{ stepca_init.container.Output }}"
+      when: stepca_init is changed
+
+- name: Write CA password file
+  ansible.builtin.copy:
+    content: "{{ stepca_ca_password }}"
+    dest: "{{ stepca_data_dir }}/secrets/password"
+    owner: "1000"
+    group: "1000"
+    mode: "0600"
+  no_log: true
+
+- name: Start step-ca
+  community.docker.docker_compose_v2:
+    project_src: "{{ stepca_base_dir }}"
+    state: present

ansible/playbooks/roles/step-ca/templates/compose.yaml.j2

@@ -0,0 +1,24 @@
+---
+# Managed by Ansible — do not edit manually
+# Smallstep step-ca — SSH & X.509 Certificate Authority
+
+services:
+  step-ca:
+    image: {{ stepca_image }}:{{ stepca_image_tag }}
+    container_name: {{ stepca_container_name }}
+    restart: unless-stopped
+    ports:
+      - "{{ stepca_listen_port }}:{{ stepca_listen_port }}"
+    volumes:
+      - {{ stepca_data_dir }}:/home/step
+    environment:
+      - DOCKER_STEPCA_INIT_NAME={{ stepca_ca_name }}
+      - DOCKER_STEPCA_INIT_DNS_NAMES={{ stepca_dns_names }}
+      - DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }}
+      - DOCKER_STEPCA_INIT_SSH={{ stepca_ssh_enabled | lower }}
+    networks:
+      - {{ stepca_docker_network }}
+
+networks:
+  {{ stepca_docker_network }}:
+    external: true

ansible/playbooks/roles/step-ca/templates/env.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+STEPCA_DNS_NAMES={{ stepca_dns_names }}
+STEPCA_SSH_ENABLED={{ stepca_ssh_enabled | lower }}
+STEPCA_REMOTE_MANAGEMENT={{ stepca_remote_management | lower }}