Allow datastore key to be populated from a variable.

Author: nmaludy

README.md

@@ -45,6 +45,7 @@ Below is the list of variables you can redefine in your playbook to customize st
 | `st2_auth_username`      | `testu`       | Username used by StackStorm standalone authentication.
 | `st2_auth_password`      | `testp`       | Password used by StackStorm standalone authentication.
 | `st2_save_credentials`   | `yes`         | Save credentials for local CLI in `/root/.st2/config` file.
+| `st2_datastore_key`      | `null`        | String for the datastore key file contents. This is useful if you're deploying StackStorm to multiple nodes and they need to share the same datastore key. By default, this variable is undefined and a new random key will be generated for each node.
 | `st2_packs`              | `[ st2 ]`     | List of packs to install. This flag does not work with a `--python3` only pack.
 | **st2web**
 | `st2web_ssl_certificate`     | `null` | String with custom SSL certificate (`.crt`). If not provided, self-signed certificate will be generated.

roles/StackStorm.st2/defaults/main.yml

@@ -34,6 +34,11 @@ st2_auth_username: testu
 st2_auth_password: testp
 # Save credentials in ~/.st2/config file
 st2_save_credentials: yes
+# The string contents of the datastore key file. If you need to distribute the same key
+# to multiple StackStorm nodes, generate a datastore key and populate this variable
+# when installing on each of the ndoes.
+# Example: '{"hmacKey": {"hmacKeyString": "xxx", "size": 256}, "aesKeyString": "yyy", "mode": "CBC", "size": 256}'
+st2_datastore_key: null
 # ST2 packs to be installed (list)
 st2_packs:
   - st2

roles/StackStorm.st2/tasks/datastore.yml

@@ -13,6 +13,14 @@
   command: st2-generate-symmetric-crypto-key --key-path {{ st2_datastore_key_file }}
   args:
     creates: "{{ st2_datastore_key_file }}"
+  when: not st2_datastore_key
+
+- name: Copy st2 encryption key
+  become: yes
+  copy:
+    content: "{{ st2_datastore_key }}"
+    dest: "{{ st2_datastore_key_file }}"
+  when: st2_datastore_key
 
 - name: Fix permissions on datastore encryption key
   become: yes