Timotej Lazar
46a9ff6fc0
With a hook to restart RGW services on renewal, if there are any. Live
certificates are linked to the same path under /etc/ceph on each host,
so that the orch service spec is node-independent.
Use with something like this (port 80 must be kept free for standalone
certbot renewal):
service_type: rgw
spec:
rgw_frontend_port: 8080
rgw_frontend_extra_args:
- ssl_port=443
- ssl_private_key=/etc/ceph/privkey.pem
- ssl_certificate=/etc/ceph/fullchain.pem
extra_container_args:
- "--volume"
- "/etc/ceph:/etc/ceph:ro"
- "--volume"
- "/etc/letsencrypt:/etc/letsencrypt:ro"
44 lines
997 B
YAML
44 lines
997 B
YAML
- name: Configure /etc/hosts
|
|
template:
|
|
dest: /etc/hosts
|
|
src: hosts.j2
|
|
|
|
- name: Set up NTP servers
|
|
lineinfile:
|
|
path: /etc/systemd/timesyncd.conf
|
|
regexp: '^#?NTP='
|
|
line: 'NTP={{ ntp | join(" ") }}'
|
|
notify: restart systemd-timesyncd
|
|
|
|
- name: Generate my SSH key
|
|
openssh_keypair:
|
|
path: /root/.ssh/id_ed25519
|
|
type: ed25519
|
|
comment: "root@{{ inventory_hostname }}"
|
|
register: my_key
|
|
|
|
- name: Deploy my key on other nodes
|
|
authorized_key:
|
|
user: root
|
|
key: "{{ my_key.public_key }}"
|
|
comment: "{{ my_key.comment }}"
|
|
delegate_to: "{{ item }}"
|
|
loop: "{{ nodes | map(attribute='inventory_hostname') }}"
|
|
|
|
- name: Install required packages
|
|
package:
|
|
name:
|
|
- lvm2
|
|
- podman
|
|
|
|
- name: Install cephadm script
|
|
get_url:
|
|
url: https://download.ceph.com/rpm-{{ ceph_version }}/el9/noarch/cephadm
|
|
checksum: '{{ cephadm_checksum }}'
|
|
dest: /usr/local/bin/cephadm
|
|
mode: 0755
|
|
|
|
- include_tasks: firewall.yml
|
|
|
|
- include_tasks: cert.yml
|