maint: initial commit

entrypoint.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+#
+# KraussNet Ansible Playbook Runner Action Entrypoint
+
+set -euo pipefail
+
+if [ -z "${INPUT_PKI_CA_URL:-}" ] ; then
+    echo "Missing required input parameter 'pki_ca_url'"
+    exit 1
+fi
+if [ -z "${INPUT_PKI_FINGERPRINT:-}" ] ; then
+    echo "Missing required input parameter 'pki_fingerprint'"
+    exit 1
+fi
+if [ -z "${INPUT_PKI_PROVISIONER_PASSWORD:-}" ] ; then
+    echo "Missing required input parameter 'pki_provisioner_password'"
+    exit 1
+fi
+if [ -z "${INPUT_PLAYBOOK:-}" ] ; then
+    echo "Missing required input parameter 'playbook'"
+    exit 1
+fi
+if [ -z "${INPUT_INVENTORY:-}" ] ; then
+    echo "Missing required input parameter 'inventory'"
+    exit 1
+fi
+
+# Setup Variables
+provisioner_name=${INPUT_PKI_PROVISIONER_NAME:-"ansible"}
+provisioner_password=${INPUT_PKI_PROVISIONER_PASSWORD}
+default_cert_subject="ansible-kraussnet-action-runner@$(hostname -f)"
+user_cert_subject=${INPUT_SUBJECT:-"$default_cert_subject"}
+
+# Bootstrap the PKI Certificate Authority
+step ca bootstrap \
+    --ca-url "${INPUT_PKI_CA_URL}" \
+    --fingerprint "${INPUT_PKI_FINGERPRINT}"
+echo "Bootstrapped PKI at ${INPUT_PKI_CA_URL}"
+
+# Obtain the Host Certificate
+[ ! -d ~/.ssh ] && mkdir ~/.ssh
+echo "@cert-authority *.kraussnet.com $(step ssh config --host --roots)" > ~/.ssh/known_hosts
+echo "Obtained SSH Host Certificate Authority"
+
+# Obtain a User Certificate for Ansible
+token=$(step ca token "${user_cert_subject}" --ssh --provisioner "${provisioner_name}" --provisioner-password-file <(printf "${provisioner_password}"))
+echo "Obtained User Token from CA"
+echo $token | step crypto jwt inspect --insecure
+
+[ ! -f ~/.ssh/id_ecdsa ] && ssh-keygen -t ecdsa -f ~/.ssh/id_ecdsa -N ''
+[ -f ~/.ssh/id_ecdsa-cert.pub ] && rm ~/.ssh/id_ecdsa-cert.pub
+step ssh certificate "${user_cert_subject}" ~/.ssh/id_ecdsa.pub --sign --provisioner "${provisioner_name}" --token $token
+echo "Obtained User Certificate from CA"
+ssh-keygen -L -f ~/.ssh/id_ecdsa-cert.pub
+
+# Run a test command (will be replaced with the Ansible command)
+ssh ansible@rpi-ns1.lan.kraussnet.com 'echo "Hello from $(hostname -f)"'