trombik.cfssl

This is an ansible role for cfssl. It supports running the API server (cfssl serve).

For Everyone

Not all distributions have the API server available in their packages, so the role variables cfssl_db_* might change.

To run cfssl as a server, your package must come with a startup script and other necessary changes. As far as I know, the Ubuntu package does not include this. Therefore, support for the API server is not available for Debian-based distributions.

Requirements

None

Role Variables

cfssl_certs

This is a list of dictionaries, where each element represents a CSR.

Using trombik.cfssl

You can include the role in your tasks or other roles. Use vars to specify any role variables.

- name: Include role trombik.cfssl
  include_role:
    name: trombik.cfssl
  vars:
    cfssl_extra_packages:
      - zsh

If you want to pass a single variable that has role variables, use the specific bridge variable cfssl_vars.

- name: Include role trombik.cfssl
  include_role:
    name: trombik.cfssl
  vars:
    cfssl_vars: "{{ my_variable }}"

The example below will NOT work:

- name: Include role trombik.cfssl
  include_role:
    name: trombik.cfssl
  vars: "{{ my_variable }}"

Refer to tests/serverspec/intermediate.yml for an example of including the role multiple times to create intermediate CAs.

Debian

FreeBSD

OpenBSD

Dependencies

None

Example Playbook

This example handles cfssl and signs a few certificates.

For using the API server, see tests/serverspec/api.yml.

For creating multiple intermediate CAs under a root CA, see tests/serverspec/intermediate.yml.

---
- hosts: localhost
  roles:
    - role: ansible-role-cfssl
  vars:
    cfssl_certs:
      - name: agent1.example.com.json
        SAN: []
        profile: agent
        owner: nobody
        json:
          CN: agent1.example.com
          hosts:
            - ""
          key:
            algo: rsa
            size: 2048
      - name: backend-1.example.com.json
        SAN:
          - localhost
          - 127.0.0.1
          - 10.0.0.1
          - backend-1
        profile: backend
        json:
          CN: backend-1.example.com
          hosts:
            - ""
          key:
            algo: rsa
            size: 2048
      - name: backend-2.example.com.json
        SAN:
          - localhost
          - 127.0.0.1
          - 10.0.0.2
          - backend-2
        profile: backend
        json:
          CN: backend-2.example.com
          hosts:
            - ""
          key:
            algo: rsa
            size: 2048
      - name: backend-3.example.com.json
        SAN:
          - localhost
          - 127.0.0.1
          - 10.0.0.3
          - backend-3
        profile: backend
        json:
          CN: backend-3.example.com
          hosts:
            - ""
          key:
            algo: rsa
            size: 2048
    cfssl_ca_config:
      signing:
        default:
          expiry: 17520h
          usages:
            - signing
            - key encipherment
            - client auth
        profiles:
          backend:
            expiry: 4320h
            usages:
              - signing
              - key encipherment
              - server auth
          agent:
            expiry: 4320h
            usages:
              - signing
              - key encipherment
              - client auth

    cfssl_ca_csr_config:
      CN: Sensu Test CA
      key:
        algo: rsa
        size: 2048

License

Copyright (c) 2020 Tomoyuki Sakurai <[email protected]>

You can use, copy, modify, and share this software for any purpose for free, as long as the copyright notice remains in all copies.

THE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTIES. THE AUTHOR IS NOT LIABLE FOR ANY DAMAGES RESULTING FROM THE USE OR PERFORMANCE OF THIS SOFTWARE.

Author Information

Tomoyuki Sakurai y@trombik.org

This README was created using qansible