61 lines
2.3 KiB
YAML
61 lines
2.3 KiB
YAML
---
|
|
- name: Create tailscale preauthkey secret for {{ _service_tailscale_container_name }}
|
|
when:
|
|
- not ansible_check_mode
|
|
- "_service_tailscale_container_name ~ '-tailscale-preauthkey' not in service_podman_secrets"
|
|
block:
|
|
- name: Get preauthkey from tailscale API
|
|
ansible.builtin.uri:
|
|
url: "{{ service_tailscale_login_server }}/api/v1/preauthkey"
|
|
headers:
|
|
Authorization: Bearer {{ service_tailscale_apikey }}
|
|
method: POST
|
|
body:
|
|
expiration: >-
|
|
{{
|
|
now(utc=true).replace(
|
|
day=now(utc=true).day if now(utc=true).hour != 23 else now(utc=true).day + 1,
|
|
hour=now(utc=true).hour + 1 if now(utc=true).hour != 23 else 0
|
|
).isoformat()
|
|
}}Z
|
|
aclTags:
|
|
- tag:container
|
|
- "tag:{{ _service_tailscale_container_name }}"
|
|
body_format: json
|
|
register: _service_tailscale_preauthkey
|
|
- name: Create preauthkey secret
|
|
containers.podman.podman_secret:
|
|
name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
|
|
data: "{{ _service_tailscale_preauthkey.json.preAuthKey.key }}"
|
|
no_log: true
|
|
|
|
- name: Tailscale container for {{ _service_tailscale_container_name }}
|
|
ansible.builtin.import_role:
|
|
name: container
|
|
vars:
|
|
container_name: "{{ _service_tailscale_container_name }}-tailscale"
|
|
container_image: docker.io/tailscale/tailscale:latest
|
|
container_networks: "{{ _service_tailscale_networks }}"
|
|
container_hostname: "{{ _service_tailscale_hostname }}"
|
|
container_add_capabilities:
|
|
- NET_ADMIN
|
|
container_devices:
|
|
- source: /dev/net/tun
|
|
container_mounts:
|
|
- type: volume
|
|
source: "{{ _service_tailscale_container_name }}-tailscale"
|
|
destination: /var/lib/tailscale
|
|
container_auto_update: "{{ service_auto_update }}"
|
|
container_secrets:
|
|
- name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
|
|
target: preauthkey
|
|
container_env:
|
|
TS_STATE_DIR: /var/lib/tailscale
|
|
TS_AUTHKEY: file:/run/secrets/preauthkey
|
|
TS_EXTRA_ARGS: --login-server={{ service_tailscale_login_server }}
|
|
TS_HOSTNAME: "{{ _service_tailscale_container_name }}"
|
|
TS_AUTH_ONCE: "true"
|
|
TS_NO_LOGS_NO_SUPPORT: "true"
|
|
TS_USERSPACE: "false"
|
|
TS_ACCEPT_DNS: "true"
|