olli/debian.ansible.mariadb.server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mariadb.yml aktualisiert

Browse Source
This commit is contained in:
olli 2024-05-27 13:43:45 +02:00
parent 66fc3ec4ba
commit 05661d3c8b
1 changed files with 29 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
mariadb.yml
View File

@ -61,25 +61,32 @@
marker: "# {mark} ANSIBLE MANAGED BLOCK" marker: "# {mark} ANSIBLE MANAGED BLOCK"
block: | block: |
cd /home/docker/mariadb.{{inventory_hostname}} cd /home/docker/mariadb.{{inventory_hostname}}
[ -d ssl ] && rm -r ssl [ -d ssl ] && rm -r ssl
mkdir ssl mkdir ssl
cd ssl cd ssl
openssl genrsa 4096 > ca-key.pem # take letsencrypt-certs from traefik
openssl req -new -x509 -nodes -days 109500 -key ca-key.pem -subj "/C=MD/ST=mariadb/L=mariadb/O=DB/CN=mariadb.{{inventory_hostname}}" > ca-cert.pem cat /home/docker/traefik/letsencrypt/acme.json | jq -r ".letsencrypt.Certificates[] | select(.domain.main==\"mail.{{inventory_hostname}}\") | .key" | base64 -d >/home/docker/mailcow-dockerized/data/assets/ssl/server-key.pem
cat /home/docker/traefik/letsencrypt/acme.json | jq -r ".letsencrypt.Certifcates[] | select(.domain.main==\"mail.{{inventory_hostname}}\") | .certificate" | base64 -d >/home/docker/mailcow-dockerized/data/assets/ssl/server-cert.pem
openssl req -newkey rsa:4096 -days 109500 -nodes -keyout server-key-pkcs8.pem -subj "/C=MD/ST=mariadb/L=mariadb/O=DB/CN=mariadb.{{inventory_hostname}}" > server-req.pem docker restart $(docker ps -qaf name=postfix-mailcow)
openssl rsa -in server-key-pkcs8.pem -out server-key.pem docker restart $(docker ps -qaf name=dovecot-mailcow)
openssl x509 -req -in server-req.pem -days 109500 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
openssl req -newkey rsa:4096 -days 109500 -nodes -keyout client-key-pkcs8.pem -subj "/C=MD/ST=mariadb/L=mariadb/O=DB/CN=mariadb.{{inventory_hostname}}" > client-req.pem
openssl rsa -in client-key-pkcs8.pem -out client-key.pem
openssl x509 -req -in client-req.pem -days 109500 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem
chmod 400 *.pem chmod 400 *.pem
chown 999 *.pem chown 999 *.pem
#openssl genrsa 4096 > ca-key.pem
#openssl req -new -x509 -nodes -days 109500 -key ca-key.pem -subj "/C=MD/ST=mariadb/L=mariadb/O=DB/CN=mariadb.{{inventory_hostname}}" > ca-cert.pem
#
#openssl req -newkey rsa:4096 -days 109500 -nodes -keyout server-key-pkcs8.pem -subj "/C=MD/ST=mariadb/L=mariadb/O=DB/CN=mariadb.{{inventory_hostname}}" > server-req.pem
#openssl rsa -in server-key-pkcs8.pem -out server-key.pem
#openssl x509 -req -in server-req.pem -days 109500 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
#
#openssl req -newkey rsa:4096 -days 109500 -nodes -keyout client-key-pkcs8.pem -subj "/C=MD/ST=mariadb/L=mariadb/O=DB/CN=mariadb.{{inventory_hostname}}" > client-req.pem
#openssl rsa -in client-key-pkcs8.pem -out client-key.pem
#openssl x509 -req -in client-req.pem -days 109500 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem
#
#chmod 400 *.pem
#chown 999 *.pem
backup: yes backup: yes
validate: /bin/bash -n %s validate: /bin/bash -n %s
@ -106,7 +113,7 @@
block: | block: |
[mariadbd] [mariadbd]
ssl=1 ssl=1
ssl-ca=/etc/mysql/ca-cert.pem #ssl-ca=/etc/mysql/ca-cert.pem
ssl-cert=/etc/mysql/server-cert.pem ssl-cert=/etc/mysql/server-cert.pem
ssl-key=/etc/mysql/server-key.pem ssl-key=/etc/mysql/server-key.pem
backup: yes backup: yes
@ -125,11 +132,11 @@
// Use SSL for connection // Use SSL for connection
$cfg['Servers'][$i]['ssl'] = true; $cfg['Servers'][$i]['ssl'] = true;
// Client secret key // Client secret key
$cfg['Servers'][$i]['ssl_key'] = '/etc/phpmyadmin/client-key.pem'; //$cfg['Servers'][$i]['ssl_key'] = '/etc/phpmyadmin/client-key.pem';
// Client certificate // Client certificate
$cfg['Servers'][$i]['ssl_cert'] = '/etc/phpmyadmin/client-cert.pem'; //$cfg['Servers'][$i]['ssl_cert'] = '/etc/phpmyadmin/client-cert.pem';
// Server certification authority // Server certification authority
$cfg['Servers'][$i]['ssl_ca'] = '/etc/phpmyadmin/ca-cert.pem'; //$cfg['Servers'][$i]['ssl_ca'] = '/etc/phpmyadmin/ca-cert.pem';
// Disable SSL verification // Disable SSL verification
//$cfg['Servers'][$i]['ssl_verify'] = false; //$cfg['Servers'][$i]['ssl_verify'] = false;
backup: yes backup: yes
@ -158,7 +165,7 @@
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
- /home/docker/_defaults/mariadb/99-server.cnf:/etc/mysql/mariadb.conf.d/99-server.cnf:ro - /home/docker/_defaults/mariadb/99-server.cnf:/etc/mysql/mariadb.conf.d/99-server.cnf:ro
- ./ssl.cnf:/etc/mysql/mariadb.conf.d/99-ssl.cnf:ro - ./ssl.cnf:/etc/mysql/mariadb.conf.d/99-ssl.cnf:ro
- ./ssl/ca-cert.pem:/etc/mysql/ca-cert.pem:ro #- ./ssl/ca-cert.pem:/etc/mysql/ca-cert.pem:ro
- ./ssl/server-cert.pem:/etc/mysql/server-cert.pem:ro - ./ssl/server-cert.pem:/etc/mysql/server-cert.pem:ro
- ./ssl/server-key.pem:/etc/mysql/server-key.pem:ro - ./ssl/server-key.pem:/etc/mysql/server-key.pem:ro
env_file: env_file:
@ -177,9 +184,9 @@
volumes: volumes:
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
- ./phpmyadmin-config.user.inc.php:/etc/phpmyadmin/config.user.inc.php:ro - ./phpmyadmin-config.user.inc.php:/etc/phpmyadmin/config.user.inc.php:ro
- ./ssl/ca-cert.pem:/etc/phpmyadmin/ca-cert.pem:ro #- ./ssl/ca-cert.pem:/etc/phpmyadmin/ca-cert.pem:ro
- ./ssl/client-cert.pem:/etc/phpmyadmin/client-cert.pem:ro #- ./ssl/client-cert.pem:/etc/phpmyadmin/client-cert.pem:ro
- ./ssl/client-key.pem:/etc/phpmyadmin/client-key.pem:ro #- ./ssl/client-key.pem:/etc/phpmyadmin/client-key.pem:ro
networks: networks:
- mariadb.{{inventory_hostname}}--network - mariadb.{{inventory_hostname}}--network
- traefik - traefik