feat: TLS encryption for Director / WebUI connection

defaults/main.yml

@@ -30,6 +30,21 @@ bareos_dir_tls_enable: yes
 # Verify the peer.
 bareos_dir_tls_verify_peer: no
 
+# The path of the CA certificate file.
+bareos_dir_ca_cert:
+  src: ""
+  dest: "/etc/bareos/bareosCA.pem"
+
+# The path of the client certificate of the director
+bareos_dir_tls_cert:
+  src: ""
+  dest: "/etc/bareos/director.pem"
+
+# The path of the client certificate key of the director
+bareos_dir_tls_cert_key:
+  src: ""
+  dest: "/etc/bareos/director.key"
+
 # A list of catalogs to configure.
 bareos_dir_catalogs: []
 

meta/argument_specs.yml

@@ -39,6 +39,15 @@ argument_specs:
         type: "bool"
         default: no
         description: "Verify the peer."
+      bareos_dir_tls_ca_cert:
+        type: "str"
+        description: "The CA Certificate for the Director"
+      bareos_dir_tls_cert:
+        type: "str"
+        description: "The TLS certificate of the director"
+      bareos_dir_tls_cert_key:
+        type: "str"
+        description: "The TLS certificate key of the director"
       bareos_dir_catalogs:
         type: "list"
         default: []

tasks/assert.yml

@@ -60,6 +60,24 @@
       - bareos_dir_tls_verify_peer is boolean
     quiet: true
 
+- name: assert | Test bareos_dir_tls_ca_cert
+  ansible.builtin.assert:
+    that:
+      - bareos_dir_tls_ca_cert is defined
+      - bareos_dir_tls_ca_cert is string
+
+- name: assert | Test bareos_dir_tls_cert
+  ansible.builtin.assert:
+    that:
+      - bareos_dir_tls_cert is defined
+      - bareos_dir_tls_cert is string
+
+- name: assert | Test bareos_dir_tls_cert_key
+  ansible.builtin.assert:
+    that:
+      - bareos_dir_tls_cert_key is defined
+      - bareos_dir_tls_cert_key is string
+
 - name: assert | Test bareos_dir_catalogs
   ansible.builtin.assert:
     that:

tasks/main.yml

@@ -53,6 +53,21 @@
 - name: Run handlers
   ansible.builtin.meta: flush_handlers
 
+- name: Place TLS certificates
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: bareos
+    group: bareos
+    mode: "0640"
+    backup: "{{ bareos_dir_backup_configurations }}"
+  loop:
+    - bareos_dir_tls_ca_cert
+    - bareos_dir_tls_cert
+    - bareos_dir_tls_cert_key
+  when:
+    - bareos_dir_tls_enable
+
 - name: Place bareos-dir.conf
   ansible.builtin.template:
     src: bareos-dir.conf.j2

templates/bareos-dir.conf.j2

@@ -18,4 +18,13 @@ Director {
   Plugin Names = "{{ bareos_dir_plugin_name }}"
   Plugin Directory = "{{ bareos_dir_plugin_dir }}"
 {% endif %}
+{% if bareos_dir_tls_ca_cert is defined and bareos_dir_tls_ca_cert != "" %}
+  TLS CA Certificate File = "{{ bareos_dir_tls_ca_cert }}"
+{% endif %}
+{% if bareos_dir_tls_cert is defined and bareos_dir_tls_cert != "" %}
+  TLS Certificate = "{{ bareos_dir_tls_cert }}"
+{% endif %}
+{% if bareos_dir_tls_cert_key is defined and bareos_dir_tls_cert_key != "" %}
+  TLS Key = "{{ bareos_dir_tls_cert_key }}"
+{% endif %}
 }