92b2a9d609
- Move all roles from playbooks/roles/ to roles/ - Update roles_path in ansible.cfg - Add cast user to common role - Create standalone podman role - Add semaphore role with Podman + Quadlet support
58 lines
1.8 KiB
Django/Jinja
58 lines
1.8 KiB
Django/Jinja
#!/usr/bin/env python3
|
|
# Managed by Ansible — do not edit manually
|
|
# Patches the OIDC provisioner in step-ca's ca.json with values from Ansible vars
|
|
import json
|
|
import sys
|
|
|
|
ca_json_path = "{{ stepca_data_dir }}/config/ca.json"
|
|
provisioner_name = "{{ stepca_oidc_provisioner_name }}"
|
|
desired_domains = {{ stepca_oidc_domains | to_json }}
|
|
desired_client_id = "{{ stepca_oidc_client_id }}"
|
|
desired_client_secret = "{{ stepca_oidc_client_secret }}"
|
|
desired_config_endpoint = "{{ stepca_oidc_configuration_endpoint }}"
|
|
desired_listen_address = "{{ stepca_oidc_listen_address }}"
|
|
|
|
with open(ca_json_path) as f:
|
|
cfg = json.load(f)
|
|
|
|
changed = False
|
|
found = False
|
|
|
|
for p in cfg["authority"]["provisioners"]:
|
|
if p.get("name") == provisioner_name and p.get("type") == "OIDC":
|
|
found = True
|
|
updates = {
|
|
"domains": desired_domains,
|
|
"clientID": desired_client_id,
|
|
"clientSecret": desired_client_secret,
|
|
"configurationEndpoint": desired_config_endpoint,
|
|
"listenAddress": desired_listen_address,
|
|
}
|
|
for key, value in updates.items():
|
|
if p.get(key) != value:
|
|
p[key] = value
|
|
changed = True
|
|
break
|
|
|
|
if not found:
|
|
# Add the OIDC provisioner if it doesn't exist
|
|
cfg["authority"]["provisioners"].append({
|
|
"type": "OIDC",
|
|
"name": provisioner_name,
|
|
"clientID": desired_client_id,
|
|
"clientSecret": desired_client_secret,
|
|
"configurationEndpoint": desired_config_endpoint,
|
|
"domains": desired_domains,
|
|
"listenAddress": desired_listen_address,
|
|
"claims": {"enableSSHCA": True},
|
|
"options": {"x509": {}, "ssh": {}},
|
|
})
|
|
changed = True
|
|
|
|
if changed:
|
|
with open(ca_json_path, "w") as f:
|
|
json.dump(cfg, f, indent=8)
|
|
print("CHANGED")
|
|
else:
|
|
print("OK")
|