71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
---
|
|
- name: 安装每日证书续签控制任务
|
|
hosts: pg-laptop
|
|
become: true
|
|
gather_facts: false
|
|
tasks:
|
|
- name: 创建 root 管理的程序目录
|
|
ansible.builtin.file:
|
|
path: /opt/homelab-postgresql-controller
|
|
state: directory
|
|
mode: '0755'
|
|
- name: 安装短期身份包装器
|
|
ansible.builtin.copy:
|
|
src: ../run.py
|
|
dest: /opt/homelab-postgresql-controller/run.py
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
- name: 安装固定 Ansible 配置副本
|
|
ansible.builtin.copy:
|
|
src: "{{ playbook_dir }}/"
|
|
dest: /opt/homelab-postgresql-controller/ansible/
|
|
owner: root
|
|
group: root
|
|
mode: preserve
|
|
- name: 使用 SPIFFE 执行一次续签预检（不输出 token）
|
|
ansible.builtin.command:
|
|
argv: [python3, /opt/homelab-postgresql-controller/run.py, --spiffe, ansible, renew-certificates.yml]
|
|
environment:
|
|
PG_BAO_SPIFFE_ROLE: homelab-postgresql
|
|
PATH: /home/panxiao81/.local/bin:/usr/local/bin:/usr/bin:/bin
|
|
become: true
|
|
become_user: panxiao81
|
|
changed_when: false
|
|
- name: 安装续签 service
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/homelab-postgresql-renew.service
|
|
mode: '0644'
|
|
content: |
|
|
[Unit]
|
|
Description=Renew shared PostgreSQL certificates using short-lived SPIFFE identity
|
|
After=network-online.target
|
|
[Service]
|
|
Type=oneshot
|
|
User=panxiao81
|
|
Environment=HOME=/home/panxiao81
|
|
Environment=PATH=/home/panxiao81/.local/bin:/usr/local/bin:/usr/bin:/bin
|
|
Environment=PG_BAO_SPIFFE_ROLE=homelab-postgresql
|
|
ExecStart=/usr/bin/python3 /opt/homelab-postgresql-controller/run.py --spiffe ansible renew-certificates.yml
|
|
TimeoutStartSec=14min
|
|
UMask=0077
|
|
- name: 安装每日 timer
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/homelab-postgresql-renew.timer
|
|
mode: '0644'
|
|
content: |
|
|
[Unit]
|
|
Description=Daily shared PostgreSQL certificate renewal
|
|
[Timer]
|
|
OnCalendar=*-*-* 04:30:00 UTC
|
|
RandomizedDelaySec=15min
|
|
Persistent=true
|
|
[Install]
|
|
WantedBy=timers.target
|
|
- name: 预检通过后启用调度
|
|
ansible.builtin.systemd_service:
|
|
name: homelab-postgresql-renew.timer
|
|
daemon_reload: true
|
|
enabled: true
|
|
state: started
|