--- - name: Prepare, test fixtures hosts: localhost connection: local gather_facts: false tasks: - name: Initialise CA hierarchy command: "gimmecert init" args: creates: ".gimmecert/ca/level1.cert.pem" chdir: "tests/data/" - name: Generate server private keys and certificates command: args: chdir: "tests/data/" creates: ".gimmecert/server/{{ item.name }}.cert.pem" argv: "{{ ['gimmecert', 'server', item.name] + item.fqdn }}" with_items: - name: ldap-server_ldap fqdn: - ldap-server - name: parameters-mandatory-bookworm_xmpp fqdn: - parameters-mandatory - domain1 - proxy.domain1 - conference.domain1 - name: parameters-optional-bookworm_xmpp fqdn: - parameters-optional - domain2 - proxy.domain2 - conference.domain2 - domain3 - proxy.domain3 - conference.domain3 - name: Set-up link to generated X.509 material file: src: ".gimmecert" dest: "tests/data/x509" state: link - name: Prepare hosts: all become: true gather_facts: false tasks: - name: Install python for Ansible raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal) become: true changed_when: false - name: Update all caches to avoid errors due to missing remote archives apt: update_cache: true changed_when: false - name: Install tools for testing apt: name: - gnutls-bin - nmap state: present - name: Use name provided via CLI when running STARTTLS handshake for XMPP via nmap replace: path: "/usr/share/nmap/nselib/sslcert.lua" regexp: "host\\.name\\)" replace: "host.targetname)" - name: Prepare, test fixtures hosts: bookworm become: true tasks: - name: Enable TLSv1.0+ in global OpenSSL configuration file in order to be able to test the web_server_tls_protocols parameter blockinfile: path: "/etc/ssl/openssl.cnf" block: | [openssl_init] ssl_conf = ssl_sect [ssl_sect] system_default = system_default_sect [system_default_sect] MinProtocol = TLSv1.1 CipherString = DEFAULT@SECLEVEL=0 owner: root group: root mode: 0644 state: present - name: Set-up the hosts file lineinfile: path: /etc/hosts regexp: "^{{ item.key }}" line: "{{ item.key }} {{ item.value }}" owner: root group: root mode: 0644 state: present with_dict: 192.168.56.11: "ldap-server backup-server" 192.168.56.21: "client-bookworm" 192.168.56.31: "parameters-mandatory domain1 proxy.domain1 conference.domain1" 192.168.56.32: "parameters-optional domain2 proxy.domain2 conference.domain2 domain3 proxy.domain3 conference.domain3" - name: Prepare, helpers hosts: clients become: true tasks: - name: Install tool for testing TCP connectivity apt: name: hping3 state: present - name: Deploy CA certificate copy: src: tests/data/x509/ca/level1.cert.pem dest: /usr/local/share/ca-certificates/testca.crt owner: root group: root mode: 0644 notify: - Update CA certificate cache - name: Install console-based XMPP client (for interactive testing) apt: name: mcabber state: present - name: Install console-based XMPP tool (for non-interactive testing) apt: name: go-sendxmpp state: present - name: Create dedicated group for testing group: name: user state: present - name: Create dedicated user for testing user: name: user group: user shell: /bin/bash - name: Deploy mcabber configuration files template: src: tests/data/mcabber.cfg.j2 dest: "~user/{{ item.jid }}.cfg" owner: user group: user mode: 0600 with_items: - jid: john.doe@domain1 password: johnpassword server: domain1 security: tls nickname: john.doe - jid: jane.doe@domain2 password: janepassword server: domain2 security: ssl nickname: jane.doe - jid: mick.doe@domain3 password: mickpassword server: domain3 security: tls nickname: mick.doe - jid: noxmpp@domain1 password: noxmpppassword server: domain1 security: tls nickname: noxmpp handlers: - name: Update CA certificate cache # noqa no-changed-when command: /usr/sbin/update-ca-certificates --fresh # [no-changed-when] Commands should not change things if nothing needs doing # Does not matter in test prepare stage. - name: Prepare, helpers hosts: ldap-server become: true roles: - ldap_server - backup_server - name: Prepare, test fixtures hosts: ldap-server become: true tasks: - name: Create LDAP accounts for testing ldap_entry: dn: "{{ item.dn }}" objectClass: "{{ item.objectClass }}" attributes: "{{ item.attributes }}" with_items: - dn: uid=john,ou=people,dc=local objectClass: - inetOrgPerson - simpleSecurityObject attributes: userPassword: johnpassword uid: john cn: John Doe sn: Doe mail: john.doe@domain1 - dn: uid=jane,ou=people,dc=local objectClass: - inetOrgPerson - simpleSecurityObject attributes: userPassword: janepassword uid: jane cn: Jane Doe sn: Doe mail: jane.doe@domain2 - dn: uid=mick,ou=people,dc=local objectClass: - inetOrgPerson - simpleSecurityObject attributes: userPassword: mickpassword uid: mick cn: Mick Doe sn: Doe mail: mick.doe@domain3 - dn: uid=noxmpp,ou=people,dc=local objectClass: - inetOrgPerson - simpleSecurityObject attributes: userPassword: noxmpppassword uid: noxmpp cn: No XMPP sn: XMPP mail: noxmpp@domain1 - name: Add test accounts to correct group ldap_attr: dn: "cn=xmpp,ou=groups,dc=local" name: uniqueMember state: exact values: - uid=john,ou=people,dc=local - uid=jane,ou=people,dc=local - uid=mick,ou=people,dc=local - uid=eve,ou=people,dc=local - name: Prepare, test fixtures hosts: parameters-mandatory,parameters-optional become: true tasks: - name: Install console-based XMPP tool (for non-interactive testing) apt: name: "{{ sendxmpp_package }}" state: present vars: sendxmpp_package: "go-sendxmpp" - name: Deploy small Lua script for listing the enabled modules in Prosody copy: src: list_prosody_modules.lua dest: "/usr/local/bin/list_prosody_modules.lua" owner: root group: root mode: 0755