Skip to content

Commit 09ab8f7

Browse files
terion-labsterion-labs
committed
Bootstrap TLS retire
1 parent e9b83c6 commit 09ab8f7

2 files changed

Lines changed: 53 additions & 38 deletions

File tree

‎ansible/site.yml‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -272,24 +272,36 @@
272272
until: terrarium_post_proxy_sync.rc == 0
273273
changed_when: false
274274

275-
- name: Remove local auth bootstrap routes before requesting public TLS
275+
- name: Retire local auth bootstrap TLS before verifying public TLS
276276
ansible.builtin.file:
277277
path: "{{ item }}"
278278
state: absent
279279
loop:
280280
- "{{ terrarium_traefik_config_dir }}/dynamic/bootstrap-routes.yml"
281-
register: terrarium_bootstrap_routes_removed
281+
- "{{ terrarium_traefik_config_dir }}/dynamic/bootstrap-cert.yml"
282+
- "{{ terrarium_traefik_config_dir }}/bootstrap-certs"
283+
- /usr/local/share/ca-certificates/terrarium-bootstrap.crt
284+
register: terrarium_bootstrap_tls_retired
282285
when:
283286
- terrarium_idp_mode == 'local'
284287
- terrarium_auth_domain | default('') | length > 0
285288

286-
- name: Restart Traefik after removing bootstrap routes
289+
- name: Refresh system CA certificates after retiring bootstrap TLS
290+
ansible.builtin.command: update-ca-certificates
291+
changed_when: terrarium_bootstrap_tls_retired is changed
292+
when: terrarium_bootstrap_tls_retired is changed
293+
294+
- name: Restart LXD after retiring bootstrap TLS trust
295+
ansible.builtin.command: systemctl try-restart snap.lxd.daemon.service
296+
when: terrarium_bootstrap_tls_retired is changed
297+
298+
- name: Restart Traefik after retiring bootstrap TLS
287299
ansible.builtin.systemd:
288300
name: traefik
289301
state: restarted
290-
when: terrarium_bootstrap_routes_removed is changed
302+
when: terrarium_bootstrap_tls_retired is changed
291303

292-
- name: Wait for local auth domain to serve trusted TLS
304+
- name: Wait for local auth domain to serve public TLS
293305
ansible.builtin.command:
294306
argv:
295307
- curl
@@ -303,27 +315,27 @@
303315
- --max-time
304316
- "20"
305317
- "https://{{ terrarium_auth_domain }}/.well-known/openid-configuration"
306-
register: terrarium_auth_trusted_tls
318+
register: terrarium_auth_public_tls
307319
retries: 36
308320
delay: 10
309-
until: terrarium_auth_trusted_tls.rc == 0
321+
until: terrarium_auth_public_tls.rc == 0
310322
changed_when: false
311323
failed_when: false
312324
when:
313325
- terrarium_idp_mode == 'local'
314326
- terrarium_auth_domain | default('') | length > 0
315327

316-
- name: Restart Traefik to retry local auth TLS after trusted TLS wait failure
328+
- name: Restart Traefik to retry local auth ACME after public TLS wait failure
317329
ansible.builtin.systemd:
318330
name: traefik
319331
state: restarted
320332
when:
321333
- terrarium_idp_mode == 'local'
322334
- terrarium_auth_domain | default('') | length > 0
323-
- terrarium_auth_trusted_tls is defined
324-
- terrarium_auth_trusted_tls.rc | default(0) != 0
335+
- terrarium_auth_public_tls is defined
336+
- terrarium_auth_public_tls.rc | default(0) != 0
325337

326-
- name: Wait again for local auth domain to serve trusted TLS after retry
338+
- name: Wait again for local auth domain to serve public TLS after ACME retry
327339
ansible.builtin.command:
328340
argv:
329341
- curl
@@ -337,19 +349,19 @@
337349
- --max-time
338350
- "20"
339351
- "https://{{ terrarium_auth_domain }}/.well-known/openid-configuration"
340-
register: terrarium_auth_trusted_tls_retry
352+
register: terrarium_auth_public_tls_retry
341353
retries: 36
342354
delay: 10
343-
until: terrarium_auth_trusted_tls_retry.rc == 0
355+
until: terrarium_auth_public_tls_retry.rc == 0
344356
changed_when: false
345357
failed_when: false
346358
when:
347359
- terrarium_idp_mode == 'local'
348360
- terrarium_auth_domain | default('') | length > 0
349-
- terrarium_auth_trusted_tls is defined
350-
- terrarium_auth_trusted_tls.rc | default(0) != 0
361+
- terrarium_auth_public_tls is defined
362+
- terrarium_auth_public_tls.rc | default(0) != 0
351363

352-
- name: Verify local auth domain serves trusted TLS after waits
364+
- name: Verify local auth domain serves public TLS after waits
353365
ansible.builtin.command:
354366
argv:
355367
- curl
@@ -363,14 +375,14 @@
363375
- --max-time
364376
- "20"
365377
- "https://{{ terrarium_auth_domain }}/.well-known/openid-configuration"
366-
register: terrarium_auth_trusted_tls_final
378+
register: terrarium_auth_public_tls_final
367379
changed_when: false
368380
failed_when: false
369381
when:
370382
- terrarium_idp_mode == 'local'
371383
- terrarium_auth_domain | default('') | length > 0
372384

373-
- name: Show local auth TLS diagnostics after trusted TLS failure
385+
- name: Show local auth TLS diagnostics after public TLS failure
374386
ansible.builtin.shell: |
375387
set +e
376388
echo "== presented certificate =="
@@ -389,17 +401,17 @@
389401
when:
390402
- terrarium_idp_mode == 'local'
391403
- terrarium_auth_domain | default('') | length > 0
392-
- terrarium_auth_trusted_tls_final is defined
393-
- terrarium_auth_trusted_tls_final.rc | default(0) != 0
404+
- terrarium_auth_public_tls_final is defined
405+
- terrarium_auth_public_tls_final.rc | default(0) != 0
394406

395-
- name: Fail when local auth domain still does not serve trusted TLS
407+
- name: Fail when local auth domain still does not serve public TLS
396408
ansible.builtin.fail:
397-
msg: "Local auth domain {{ terrarium_auth_domain }} still does not serve TLS trusted by the host; see Traefik TLS diagnostics above."
409+
msg: "Local auth domain {{ terrarium_auth_domain }} still does not serve public TLS after retiring bootstrap TLS; see Traefik TLS diagnostics above."
398410
when:
399411
- terrarium_idp_mode == 'local'
400412
- terrarium_auth_domain | default('') | length > 0
401-
- terrarium_auth_trusted_tls_final is defined
402-
- terrarium_auth_trusted_tls_final.rc | default(0) != 0
413+
- terrarium_auth_public_tls_final is defined
414+
- terrarium_auth_public_tls_final.rc | default(0) != 0
403415

404416
- name: Enable Traefik sync timer after dependent services are configured
405417
ansible.builtin.systemd:

‎tests/ansible-bootstrap-cert.test.ts‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -49,28 +49,31 @@ describe("Traefik bootstrap certificate template", () => {
4949
expect(tasks).toContain("Remove Traefik bootstrap certificate config when bootstrap TLS is not required");
5050
expect(tasks).toContain("Remove temporary Traefik bootstrap routes when bootstrap TLS is not required");
5151
expect(tasks).toContain("systemctl try-restart snap.lxd.daemon.service");
52-
expect(playbook).toContain("Remove local auth bootstrap routes before requesting public TLS");
52+
expect(playbook).toContain("Retire local auth bootstrap TLS before verifying public TLS");
5353
expect(playbook).toContain("dynamic/bootstrap-routes.yml");
54-
expect(playbook).not.toContain('"{{ terrarium_traefik_config_dir }}/dynamic/bootstrap-cert.yml"');
55-
expect(playbook).not.toContain('"{{ terrarium_traefik_config_dir }}/bootstrap-certs"');
56-
expect(playbook).not.toContain("/usr/local/share/ca-certificates/terrarium-bootstrap.crt");
57-
expect(playbook).toContain("Wait for local auth domain to serve trusted TLS");
58-
expect(playbook).toContain("Restart Traefik to retry local auth TLS after trusted TLS wait failure");
59-
expect(playbook).toContain("Wait again for local auth domain to serve trusted TLS after retry");
60-
expect(playbook).toContain("Verify local auth domain serves trusted TLS after waits");
61-
expect(playbook).toContain("Show local auth TLS diagnostics after trusted TLS failure");
54+
expect(playbook).toContain('"{{ terrarium_traefik_config_dir }}/dynamic/bootstrap-cert.yml"');
55+
expect(playbook).toContain('"{{ terrarium_traefik_config_dir }}/bootstrap-certs"');
56+
expect(playbook).toContain("/usr/local/share/ca-certificates/terrarium-bootstrap.crt");
57+
expect(playbook).toContain("Refresh system CA certificates after retiring bootstrap TLS");
58+
expect(playbook).toContain("Restart LXD after retiring bootstrap TLS trust");
59+
expect(playbook).toContain("Restart Traefik after retiring bootstrap TLS");
60+
expect(playbook).toContain("Wait for local auth domain to serve public TLS");
61+
expect(playbook).toContain("Restart Traefik to retry local auth ACME after public TLS wait failure");
62+
expect(playbook).toContain("Wait again for local auth domain to serve public TLS after ACME retry");
63+
expect(playbook).toContain("Verify local auth domain serves public TLS after waits");
64+
expect(playbook).toContain("Show local auth TLS diagnostics after public TLS failure");
6265
expect(playbook).toContain('TERRARIUM_AUTH_DOMAIN: "{{ terrarium_auth_domain }}"');
6366
expect(playbook).toContain('TERRARIUM_TRAEFIK_CONFIG_DIR: "{{ terrarium_traefik_config_dir }}"');
6467
expect(playbook).toContain('-servername "$TERRARIUM_AUTH_DOMAIN"');
6568
expect(playbook).toContain('"$TERRARIUM_TRAEFIK_CONFIG_DIR/traefik.yml"');
6669
expect(playbook).not.toContain('-servername "{{ terrarium_auth_domain }}"');
6770
expect(playbook).not.toContain('"{{ terrarium_traefik_config_dir }}/traefik.yml"');
68-
expect(playbook).toContain("Fail when local auth domain still does not serve trusted TLS");
69-
expect(playbook).toContain("terrarium_auth_trusted_tls_final.rc");
71+
expect(playbook).toContain("Fail when local auth domain still does not serve public TLS");
72+
expect(playbook).toContain("terrarium_auth_public_tls_final.rc");
7073
expect(playbook).toContain("journalctl -u traefik");
71-
expect(playbook).toContain("terrarium_bootstrap_routes_removed is changed");
72-
expect(playbook.indexOf("Remove local auth bootstrap routes before requesting public TLS")).toBeLessThan(
73-
playbook.indexOf("Wait for local auth domain to serve trusted TLS")
74+
expect(playbook).toContain("terrarium_bootstrap_tls_retired is changed");
75+
expect(playbook.indexOf("Retire local auth bootstrap TLS before verifying public TLS")).toBeLessThan(
76+
playbook.indexOf("Wait for local auth domain to serve public TLS")
7477
);
7578
});
7679

0 commit comments

Comments
 (0)