43 lines
1.9 KiB
YAML
43 lines
1.9 KiB
YAML
---
|
|
# file: roles/redis/tasks/users.yml
|
|
|
|
- name: "handle secret {{ ansible_hostname }}/redis_{{ user.name }}_password"
|
|
block:
|
|
- name: "get {{ ansible_hostname }}/redis_{{ user.name }}_password from hashicorp vault"
|
|
ansible.builtin.set_fact:
|
|
"{{ user.name }}_password": "#{{ lookup('hashi_vault', 'secret=talas-kv/data/' + host_vars_location + '/' + ansible_hostname)['redis_' + user.name + '_password'] | hash('sha256') }}"
|
|
rescue:
|
|
- name: "generate a random password for {{ ansible_hostname }}/redis_{{ user.name }}_password"
|
|
ansible.builtin.set_fact:
|
|
password: "{{ lookup('password','/dev/null chars=ascii_letters,digits length=50') }}"
|
|
- name: "patching hashicorp vault with generated redis_{{ user.name }}_password"
|
|
ansible.builtin.command: "vault kv patch talas-kv/{{ host_vars_location }}/{{ ansible_hostname }} redis_{{ user.name }}_password={{ password }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: result
|
|
ignore_errors: true
|
|
- name: "patch failed because the entry doesn't exist, creating it instead"
|
|
ansible.builtin.command: "vault kv put talas-kv/{{ host_vars_location }}/{{ ansible_hostname }} redis_{{ user.name }}_password={{ password }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
when:
|
|
- result.failed
|
|
- '"No value found" in result.stderr'
|
|
- name: "assign password value to redis_{{ user.name }}_password"
|
|
ansible.builtin.set_fact:
|
|
"{{ user.name }}_password": "#{{ password | hash('sha256') }}"
|
|
when:
|
|
- user.password == "auto"
|
|
|
|
- name: "hash non auto password to sha256"
|
|
ansible.builtin.set_fact:
|
|
"{{ user.name }}_password": "#{{ user.password | hash('sha256') }}"
|
|
when:
|
|
- user.password != "auto"
|
|
- user.password != "nopass"
|
|
|
|
- name: "set nopass"
|
|
ansible.builtin.set_fact:
|
|
"{{ user.name }}_password": "nopass"
|
|
when:
|
|
- user.password == "nopass"
|