Add root and intermediate CA creation with GitLab TLS support

.vscode/tasks.json

@@ -45,6 +45,18 @@
         }
       ]
     },
+    {
+      "label": "ansible: setup PKI",
+      "type": "shell",
+      "command": "${workspaceFolder}/scripts/deploy.py",
+      "args": [
+        "--host",
+        "${input:targetHost}",
+        "--tags",
+        "pki"
+      ],
+      "problemMatcher": []
+    },
     {
       "label": "ansible: deploy gitlab to host",
       "type": "shell",

ansible/playbooks/gitlab_setup.yml

@@ -3,13 +3,19 @@
   hosts: all
   become: false
 
+  vars:
+    gitlab_external_host: >-
+      {{ ansible_facts['fqdn'] | default(ansible_facts['hostname'], true) }}
+
   pre_tasks:
     - name: Show deployment target
       ansible.builtin.debug:
         msg: "Deploying to {{ inventory_hostname }} ({{ ansible_host | default(inventory_hostname) }})"
       tags: [always]
 
   roles:
+    - role: pki
+      tags: [pki, service]
     - role: gitlab_service
       tags: [service]
     - role: gitlab_runner

ansible/roles/gitlab_runner/defaults/main.yml

@@ -11,12 +11,16 @@ gitlab_runner_job_image: "localhost/gitlab-runner-image:latest"
 gitlab_runner_job_image_pull_policy:
   - if-not-present
 gitlab_runner_job_network: host
-gitlab_runner_gitlab_url: "http://jupiter:8081"
+gitlab_runner_gitlab_url: "https://{{ gitlab_external_host }}:8081"
 gitlab_runner_token: ""
 gitlab_runner_name: "{{ ansible_facts['fqdn'] | default(ansible_facts['hostname'], true) }}"
 gitlab_runner_service_name: gitlab-runner
 gitlab_runner_config_dir: "/var/lib/gitlab-runner/config"
 gitlab_runner_builds_dir: "/var/lib/gitlab-runner/builds"
+gitlab_runner_ca_dir: "{{ gitlab_runner_config_dir }}/certs"
+gitlab_runner_ca_certificate: "{{ gitlab_runner_ca_dir }}/root-ca.crt"
+gitlab_runner_ca_container_certificate: /etc/gitlab-runner/certs/root-ca.crt
+gitlab_runner_job_ca_certificate: "{{ gitlab_runner_ca_container_certificate }}"
 gitlab_runner_podman_socket: >-
   unix:///run/user/{{ gitlab_runner_user_uid }}/podman/podman.sock
 gitlab_runner_images:

ansible/roles/gitlab_runner/tasks/build_and_ship_image.yml

@@ -9,14 +9,13 @@
   become: false
 
 - name: Build image locally
-  containers.podman.podman_image:
-    name: "{{ container_image_name }}"
-    tag: latest
-    path: "{{ container_image_context }}"
-    state: present
-    build:
-      file: "{{ container_image_containerfile }}"
-      extra_args: "{{ container_image_build_extra_args }}"
+  ansible.builtin.command:
+    cmd: >-
+      podman build --tag {{ container_image_name | quote }}
+      --file {{ container_image_containerfile | quote }}
+      {{ container_image_build_extra_args }}
+      {{ container_image_context | quote }}
+  changed_when: true
   delegate_to: localhost
   become: false
 

ansible/roles/gitlab_runner/tasks/register.yml

@@ -8,6 +8,24 @@
     mode: "0700"
   become: true
 
+- name: Create GitLab Runner CA certificate directory
+  ansible.builtin.file:
+    path: "{{ gitlab_runner_ca_dir }}"
+    state: directory
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0755"
+  become: true
+
+- name: Deploy PKI root CA for GitLab Runner
+  ansible.builtin.copy:
+    src: "{{ pki_root_ca_certificate }}"
+    dest: "{{ gitlab_runner_ca_certificate }}"
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0644"
+  become: true
+
 - name: Create GitLab Runner builds directory
   ansible.builtin.file:
     path: "{{ gitlab_runner_builds_dir }}"
@@ -49,6 +67,8 @@
       - --non-interactive
       - --url
       - "{{ gitlab_runner_gitlab_url }}"
+      - --tls-ca-file
+      - "{{ gitlab_runner_ca_container_certificate }}"
       - --token
       - "{{ gitlab_runner_token }}"
       - --name
@@ -63,15 +83,48 @@
       - "{{ gitlab_runner_job_image }}"
       - --docker-pull-policy
       - "{{ gitlab_runner_job_image_pull_policy | first }}"
-      - --docker-network
+      - --docker-network-mode
       - "{{ gitlab_runner_job_network }}"
+      - --docker-volumes
+      - "{{ gitlab_runner_ca_certificate }}:{{ gitlab_runner_job_ca_certificate }}:ro"
+      - --env
+      - "GIT_SSL_CAINFO={{ gitlab_runner_job_ca_certificate }}"
       - --docker-privileged
   changed_when: true
   become: true
   become_user: "{{ gitlab_runner_user }}"
   no_log: true
   when: not gitlab_runner_config.stat.exists
 
+- name: Configure GitLab Runner TLS connection
+  ansible.builtin.lineinfile:
+    path: "{{ gitlab_runner_config_dir }}/config.toml"
+    regexp: "^\\s*{{ item.key }}\\s*="
+    line: "  {{ item.key }} = \"{{ item.value }}\""
+    insertafter: '^\[\[runners\]\]$'
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0600"
+  become: true
+  notify: Restart GitLab Runner service
+  loop:
+    - key: url
+      value: "{{ gitlab_runner_gitlab_url }}"
+    - key: tls-ca-file
+      value: "{{ gitlab_runner_ca_container_certificate }}"
+
+- name: Configure GitLab Runner job CA trust
+  ansible.builtin.lineinfile:
+    path: "{{ gitlab_runner_config_dir }}/config.toml"
+    regexp: "^\\s*environment\\s*="
+    line: '  environment = ["GIT_SSL_CAINFO={{ gitlab_runner_job_ca_certificate }}"]'
+    insertafter: '^\[\[runners\]\]$'
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0600"
+  become: true
+  notify: Restart GitLab Runner service
+
 - name: Configure GitLab Runner Docker executor
   ansible.builtin.lineinfile:
     path: "{{ gitlab_runner_config_dir }}/config.toml"
@@ -88,3 +141,5 @@
       value: "{{ gitlab_runner_job_image_pull_policy | to_json }}"
     - key: network_mode
       value: '"{{ gitlab_runner_job_network }}"'
+    - key: volumes
+      value: '["/cache", "{{ gitlab_runner_ca_certificate }}:{{ gitlab_runner_job_ca_certificate }}:ro"]'

ansible/roles/gitlab_runner/tasks/service.yml

@@ -10,7 +10,6 @@
     state: started
     enabled: true
 
-
 - name: Ensure Quadlet directory exists
   become: true
   become_user: "{{ gitlab_runner_user }}"
@@ -41,6 +40,6 @@
   ansible.builtin.systemd:
     name: "{{ gitlab_runner_service_name }}.service"
     scope: user
-    state: started
+    state: restarted
     enabled: true
 ...

ansible/roles/gitlab_service/defaults/main.yml

@@ -4,11 +4,17 @@ gitlab_service_name: gitlab
 gitlab_service_net: gitlabnet
 # Uses the fully qualified hostname reported by the managed host. Override in
 # inventory when GitLab is published under a different external DNS name.
-gitlab_service_external_host: "{{ ansible_facts['fqdn'] | default(ansible_facts['hostname'], true) }}"
+gitlab_service_external_host: "{{ gitlab_external_host }}"
 gitlab_service_volume_recreate: false
 gitlab_service_config_dir: /var/lib/gitlab/config
 gitlab_service_logs_dir: /var/lib/gitlab/logs
 gitlab_service_data_dir: /var/lib/gitlab/data
+gitlab_service_tls_dir: "{{ gitlab_service_config_dir }}/ssl"
+gitlab_service_tls_certificate: "{{ gitlab_service_tls_dir }}/gitlab.crt"
+gitlab_service_tls_private_key: "{{ gitlab_service_tls_dir }}/gitlab.key"
+gitlab_service_tls_container_dir: /etc/gitlab/ssl
+gitlab_service_tls_container_certificate: "{{ gitlab_service_tls_container_dir }}/gitlab.crt"
+gitlab_service_tls_container_private_key: "{{ gitlab_service_tls_container_dir }}/gitlab.key"
 
 gitlab_service_web_port: 8081
 gitlab_service_ssh_port: 2223

ansible/roles/gitlab_service/tasks/volume.yml

@@ -37,14 +37,32 @@
     - "{{ gitlab_service_logs_dir }}"
     - "{{ gitlab_service_data_dir }}"
 
-# The OpenSSH daemon bundled in the image isn't exposed as a Chef attribute
-- name: Create OpenSSH "down" marker file
+- name: Create GitLab TLS directory
   become: true
   ansible.builtin.file:
-    path: "{{ gitlab_service_config_dir }}/sshd-down"
-    state: touch
+    path: "{{ gitlab_service_tls_dir }}"
+    state: directory
+    owner: "{{ gitlab_service_user }}"
+    group: "{{ gitlab_service_user }}"
+    mode: "0700"
+
+- name: Deploy GitLab TLS private key
+  become: true
+  ansible.builtin.copy:
+    src: "{{ pki_gitlab_private_key }}"
+    dest: "{{ gitlab_service_tls_private_key }}"
+    owner: "{{ gitlab_service_user }}"
+    group: "{{ gitlab_service_user }}"
+    mode: "0600"
+  no_log: true
+
+- name: Deploy GitLab TLS certificate chain
+  become: true
+  ansible.builtin.copy:
+    content: |-
+      {{ lookup('ansible.builtin.file', pki_gitlab_certificate) }}
+      {{ lookup('ansible.builtin.file', pki_intermediate_ca_certificate) }}
+    dest: "{{ gitlab_service_tls_certificate }}"
     owner: "{{ gitlab_service_user }}"
     group: "{{ gitlab_service_user }}"
-    mode: "0640"
-    modification_time: preserve
-    access_time: preserve
+    mode: "0644"

ansible/roles/gitlab_service/templates/gitlab.rb.j2

@@ -2,7 +2,11 @@
 ## To change settings, edit the template and re-run the deploy playbook;
 ## GitLab picks this up on its next `gitlab-ctl reconfigure` (container restart).
 
-external_url 'http://{{ gitlab_service_external_host }}:{{ gitlab_service_web_port }}/'
+external_url 'https://{{ gitlab_service_external_host }}:{{ gitlab_service_web_port }}/'
+gitlab_rails['nginx']['ssl_certificate'] = '{{ gitlab_service_tls_container_certificate }}'
+gitlab_rails['nginx']['ssl_certificate_key'] = '{{ gitlab_service_tls_container_private_key }}'
+# We supply our own PKI-issued cert/key, so don't let Chef manage the SSL dir.
+letsencrypt['enable'] = false
 
 gitlab_rails['env'] = {
   'GITLAB_LOG_LEVEL' => '{{ gitlab_service_log_level }}'
@@ -23,9 +27,11 @@ logging['logrotate_compress'] = 'compress'
 
 # Container registry settings
 {% if gitlab_service_registry_enabled | bool %}
-registry_external_url 'http://{{ gitlab_service_external_host }}:{{ gitlab_service_registry_port }}'
+registry_external_url 'https://{{ gitlab_service_external_host }}:{{ gitlab_service_registry_port }}'
 gitlab_rails['registry_enabled'] = true
 registry['enable'] = true
+registry['nginx']['ssl_certificate'] = '{{ gitlab_service_tls_container_certificate }}'
+registry['nginx']['ssl_certificate_key'] = '{{ gitlab_service_tls_container_private_key }}'
 {% else %}
 gitlab_rails['registry_enabled'] = false
 registry['enable'] = false

ansible/roles/pki/defaults/main.yml

@@ -0,0 +1,28 @@
+pki_root_ca_common_name: "embtom Infrastructure Root CA"
+
+pki_country: "DE"
+pki_state: "Bayern"
+pki_organization: "embtom"
+
+pki_controller_root_dir: >-
+  {{ lookup('ansible.builtin.env', 'HOME') }}/.local/share/gitlab-infra/pki
+pki_root_ca_key: "{{ pki_controller_root_dir }}/private/root-ca.key"
+pki_root_ca_csr: "{{ pki_controller_root_dir }}/csr/root-ca.csr"
+pki_root_ca_certificate: "{{ pki_controller_root_dir }}/certs/root-ca.crt"
+
+pki_intermediate_ca_common_name: "embtom GitLab Issuing CA"
+pki_intermediate_ca_dir: "{{ pki_controller_root_dir }}/intermediate"
+pki_intermediate_ca_key: "{{ pki_intermediate_ca_dir }}/private/intermediate-ca.key"
+pki_intermediate_ca_csr: "{{ pki_intermediate_ca_dir }}/csr/intermediate-ca.csr"
+pki_intermediate_ca_certificate: >-
+  {{ pki_intermediate_ca_dir }}/certs/intermediate-ca.crt
+
+pki_gitlab_common_name: "{{ gitlab_external_host }}"
+pki_gitlab_certificate_name: >-
+  {{ gitlab_external_host | regex_replace('[^A-Za-z0-9._-]', '_') }}-server
+pki_gitlab_private_key: >-
+  {{ pki_intermediate_ca_dir }}/private/{{ pki_gitlab_certificate_name }}.key
+pki_gitlab_csr: >-
+  {{ pki_intermediate_ca_dir }}/csr/{{ pki_gitlab_certificate_name }}.csr
+pki_gitlab_certificate: >-
+  {{ pki_intermediate_ca_dir }}/certs/{{ pki_gitlab_certificate_name }}.crt

ansible/roles/pki/tasks/gitlab-certificate.yml

@@ -0,0 +1,36 @@
+---
+- name: Create GitLab TLS private key
+  community.crypto.openssl_privatekey:
+    path: "{{ pki_gitlab_private_key }}"
+    type: RSA
+    size: 4096
+    mode: "0600"
+  delegate_to: localhost
+  become: false
+
+- name: Create GitLab TLS CSR
+  community.crypto.openssl_csr:
+    path: "{{ pki_gitlab_csr }}"
+    privatekey_path: "{{ pki_gitlab_private_key }}"
+    common_name: "{{ pki_gitlab_common_name }}"
+    subject_alt_name:
+      - "DNS:{{ pki_gitlab_common_name }}"
+    key_usage:
+      - digitalSignature
+      - keyEncipherment
+    extended_key_usage:
+      - serverAuth
+  delegate_to: localhost
+  become: false
+
+- name: Sign GitLab TLS certificate with intermediate CA
+  community.crypto.x509_certificate:
+    path: "{{ pki_gitlab_certificate }}"
+    csr_path: "{{ pki_gitlab_csr }}"
+    provider: ownca
+    ownca_path: "{{ pki_intermediate_ca_certificate }}"
+    ownca_privatekey_path: "{{ pki_intermediate_ca_key }}"
+    ownca_not_after: "+365d"
+    ownca_digest: sha256
+  delegate_to: localhost
+  become: false