Use systemd credentials

defaults/main.yml

@@ -51,6 +51,14 @@ enduro_db_host: "localhost"
 enduro_db_name: "enduro"
 enduro_db_port: "3306"
 
+
+# Systemd credentials are disabled by default
+enduro_systemd_credentials: false
+
+# Configuration file defaults
+enduro_config_file: "templates/enduro.toml.j2"
+preprocessing_config_file: "templates/preprocessing-worker.toml.j2"
+
 # Enduro pipelines
 enduro_pipelines: []
 

tasks/configure-enduro.yml

@@ -1,38 +1,51 @@
 ---
 - name: Copy the enduro systemd service file
   template:
-    src: "{{ item }}"
+    src: templates/enduro.service.j2
     dest: /etc/systemd/system/enduro.service
     owner: root
     group: root
     mode: 0644
-  with_first_found:
-    - templates/{{ inventory_hostname }}/enduro.service.j2
-    - templates/enduro.service.j2
   notify: restart enduro
 
-- name: Copy the PREMIS XSD file
+- name: Copy the enduro config file
   template:
-    src: "{{ item }}"
-    dest: /etc/premis.xsd
+    src: "{{ enduro_config_file }}"
+    dest: /etc/enduro.toml
     owner: root
     group: root
     mode: 0644
-  with_first_found:
-    - templates/{{ inventory_hostname }}/premis.xsd.j2
-    - templates/premis.xsd.j2
+  when: not enduro_systemd_credentials|bool
+  notify: restart enduro
 
-- name: Copy the enduro config file
+- name: Copy the PREMIS XSD file
   template:
     src: "{{ item }}"
-    dest: /etc/enduro.toml
+    dest: /etc/premis.xsd
     owner: root
     group: root
     mode: 0644
   with_first_found:
-    - templates/{{ inventory_hostname }}/enduro.toml.j2
-    - templates/enduro.toml.j2
-  notify: restart enduro
+    - templates/{{ inventory_hostname }}/premis.xsd.j2
+    - templates/premis.xsd.j2
+- name: Use systemd credentials
+  block:
+    - include_tasks: systemd-creds.yml
+      vars:
+        service: "enduro"
+        secret_name: "enduro.toml"
+        secret_file: "{{ enduro_config_file }}"
+    - include_tasks: systemd-creds.yml
+      vars:
+        service: "enduro-am-worker"
+        secret_name: "enduro.toml"
+        secret_file: "{{ enduro_config_file }}"
+
+    - name: "Remove cleartext configuration file"
+      file:
+        path: "/etc/enduro.toml"
+        state: absent
+  when: enduro_systemd_credentials|bool
 
 - name: "Configure enduro_storage SS backend"
   mysql_query:

tasks/configure-preprocessing-worker.yml

@@ -9,6 +9,15 @@
     mode: 0755
     state: "directory"
 
+- name: Create preprocessing systemd file
+  template:
+    src: templates/preprocessing-worker.service.j2
+    dest: /etc/systemd/system/preprocessing-worker.service
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart preprocessing-worker
+
 - name: Copy the allowed file formats CSV file
   template:
     src: "{{ item }}"
@@ -22,12 +31,24 @@
 
 - name: Copy the preprocessing worker config file
   template:
-    src: "{{ item }}"
+    src: "{{ preprocessing_config_file }}"
     dest: /etc/preprocessing-worker.toml
     owner: root
     group: root
     mode: 0644
-  with_first_found:
-    - templates/{{ inventory_hostname }}/preprocessing-worker.toml.j2
-    - templates/preprocessing-worker.toml.j2
+  when: not enduro_systemd_credentials|bool
   notify: restart preprocessing-worker
+
+- name: Use systemd credentials
+  block:
+    - include_tasks: systemd-creds.yml
+      vars:
+        service: "preprocessing-worker"
+        secret_name: "preprocessing-worker.toml"
+        secret_file: "{{ preprocessing_config_file }}"
+
+    - name: "Remove cleartext configuration file"
+      file:
+        path: "/etc/preprocessing-worker.toml"
+        state: absent
+  when: enduro_systemd_credentials|bool

tasks/systemd-creds.yml

@@ -0,0 +1,14 @@
+- name: Create enduro secured credentials
+  shell: echo '{{ lookup('ansible.builtin.template', secret_file ) }}' | systemd-creds encrypt -p --name={{ secret_name }} - -
+  register: secured_credentials
+  notify: restart {{ service }}
+
+- name: "Create override dir"
+  file:
+    path: /etc/systemd/system/{{ service }}.service.d/
+    state: directory
+
+- name: "Template override file"
+  template:
+    src: templates/override.conf.j2
+    dest: /etc/systemd/system/{{ service }}.service.d/override.conf

templates/enduro-am-worker.service.j2

@@ -9,7 +9,11 @@ WorkingDirectory=/var/lib/enduro
 User=enduro
 Group=enduro
 EnvironmentFile=-/etc/sysconfig/enduro-am-worker
+{% if enduro_systemd_credentials|bool %}
+ExecStart=/usr/bin/enduro-am-worker --config $SECRETS
+{% else %}
 ExecStart=/usr/bin/enduro-am-worker --config /etc/enduro.toml
+{% endif %}
 
 # Let systemd restart this service always
 #Restart=always

templates/enduro.service.j2

@@ -8,7 +8,11 @@ Restart=on-failure
 User={{ enduro_system_user }}
 SyslogIdentifier=EnduroStdout
 SyslogFacility=local1
+{% if enduro_systemd_credentials|bool %}
+ExecStart={{ enduro_binary_install_dir }}/enduro --config $SECRETS
+{% else %}
 ExecStart={{ enduro_binary_install_dir }}/enduro --config /etc/enduro.toml
+{% endif %}
 
 [Install]
 WantedBy={{ enduro_systemd_wantedby_services }}

templates/override.conf.j2

@@ -0,0 +1,6 @@
+[Service]
+# Load secure credentials for {{ service }}
+
+{{secured_credentials.stdout }}
+
+Environment=SECRETS=%d/{{ secret_name }}

templates/preprocessing-worker.service.j2

@@ -0,0 +1,32 @@
+[Unit]
+Description=SFA preprocessing worker
+AssertFileIsExecutable=/usr/bin/preprocessing-worker
+
+
+[Service]
+Type=simple
+WorkingDirectory=/var/lib/enduro
+User=enduro
+Group=enduro
+{% if enduro_systemd_credentials|bool %}
+ExecStart=/usr/bin/preprocessing-worker --config $SECRETS
+{% else %}
+ExecStart=/usr/bin/preprocessing-worker --config /etc/preprocessing-sfa.toml
+{% endif %}
+
+
+# Let systemd restart this service always
+#Restart=always
+
+# Specifies the maximum file descriptor number that can be opened by this process
+LimitNOFILE=1048576
+
+# Specifies the maximum number of threads this process can create
+#TasksMax=infinity
+
+# Disable timeout logic and wait until process is stopped
+#TimeoutStopSec=infinity
+#SendSIGKILL=no
+
+[Install]
+WantedBy=multi-user.target