wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-06-05 06:33:56 +02:00
Code Issues Projects Releases Wiki Activity

Don't set CA facts if IPsec is disabled (#1446)

Browse source 
* Don't set CA facts if ipsec is disabled

* localhost update-users fix
This commit is contained in:
Jack Ivanov 2019-05-30 07:20:45 +02:00 • committed by GitHub
parent ecb4e555b4
commit 634c609626
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 21 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
config.cfg
View file

@ -114,7 +114,7 @@ congrats:
p12_pass: | p12_pass: |
"# The p12 and SSH keys password for new users is {{ p12_export_password }} #" "# The p12 and SSH keys password for new users is {{ p12_export_password }} #"
ca_key_pass: | ca_key_pass: |
"# The CA key password is {{ CA_password }} #" "# The CA key password is {{ CA_password|default(omit) }} #"
ssh_access: | ssh_access: |
"# Shell access: ssh -i {{ ansible_ssh_private_key_file|default(omit) }} {{ ansible_ssh_user|default(omit) }}@{{ ansible_ssh_host|default(omit) }} #" "# Shell access: ssh -i {{ ansible_ssh_private_key_file|default(omit) }} {{ ansible_ssh_user|default(omit) }}@{{ ansible_ssh_host|default(omit) }} #"

37
users.yml
View file

@ -25,7 +25,8 @@
set_fact: set_fact:
server_list: >- server_list: >-
[{% for i in _configs_list.files %} [{% for i in _configs_list.files %}
'{{ i.path.split('/')[1] }}' {% set config = lookup('file', i.path)|from_yaml %}
'{{ config.server }}'
{{ ',' if not loop.last else '' }} {{ ',' if not loop.last else '' }}
{% endfor %}] {% endfor %}]
@ -51,21 +52,21 @@
include_vars: include_vars:
file: "configs/{{ algo_server }}/.config.yml" file: "configs/{{ algo_server }}/.config.yml"
- name: CA password prompt - when: ipsec_enabled
pause: block:
prompt: Enter the password for the private CA key - name: CA password prompt
echo: false pause:
register: _ca_password prompt: Enter the password for the private CA key
when: echo: false
- ca_password is undefined register: _ca_password
- ipsec_enabled when: ca_password is undefined
- name: Set facts based on the input - name: Set facts based on the input
set_fact: set_fact:
CA_password: >- CA_password: >-
{% if ca_password is defined %}{{ ca_password }} {% if ca_password is defined %}{{ ca_password }}
{%- elif _ca_password.user_input %}{{ _ca_password.user_input }} {%- elif _ca_password.user_input %}{{ _ca_password.user_input }}
{%- else %}omit{% endif %} {%- else %}omit{% endif %}
- name: Local pre-tasks - name: Local pre-tasks
import_tasks: playbooks/cloud-pre.yml import_tasks: playbooks/cloud-pre.yml
@ -78,7 +79,7 @@
ansible_ssh_user: "{{ server_user|default('root') }}" ansible_ssh_user: "{{ server_user|default('root') }}"
ansible_connection: "{% if algo_server == 'localhost' %}local{% else %}ssh{% endif %}" ansible_connection: "{% if algo_server == 'localhost' %}local{% else %}ssh{% endif %}"
ansible_python_interpreter: "/usr/bin/python3" ansible_python_interpreter: "/usr/bin/python3"
CA_password: "{{ CA_password }}" CA_password: "{{ CA_password|default(omit) }}"
rescue: rescue:
- include_tasks: playbooks/rescue.yml - include_tasks: playbooks/rescue.yml
@ -111,7 +112,9 @@
- debug: - debug:
msg: msg:
- "{{ congrats.common.split('\n') }}" - "{{ congrats.common.split('\n') }}"
- " {% if p12.changed %}{{ congrats.p12_pass }}{% endif %}" - " {{ congrats.p12_pass if algo_ssh_tunneling or ipsec_enabled else '' }}"
- " {{ congrats.ca_key_pass if algo_store_cakey and ipsec_enabled else '' }}"
- " {{ congrats.ssh_access if algo_provider != 'local' else ''}}"
tags: always tags: always
rescue: rescue:
- include_tasks: playbooks/rescue.yml - include_tasks: playbooks/rescue.yml