Skip to content

Commit 004f2d0

Browse files
markgoddardmarkgoddard
committed
Support systemd TCP and TLS sockets
Adds support for Systemd TCP and TLS sockets. These Systemd services open a socket which is passed to libvirtd.
1 parent e1f2fdc commit 004f2d0

File tree

6 files changed

+187
-5
lines changed

6 files changed

+187
-5
lines changed

‎README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,28 @@ option names to values. Default is an empty dict.
115115
`libvirt_host_qemu_conf`: Configuration for `qemu.conf`. Dict mapping option
116116
names to values. Default is an empty dict.
117117

118+
`libvirt_host_tcp_listen`: Whether to enable the systemd TCP socket unit.
119+
Default is `false`.
120+
121+
`libvirt_host_tcp_listen_address`: Systemd TCP socket ListenStream. See man
122+
systemd.socket for format. Default is unset.
123+
124+
`libvirt_host_tls_listen`: Whether to enable the systemd TLS socket unit.
125+
Default is `false`.
126+
127+
`libvirt_host_tls_listen_address`: Systemd TLS socket ListenStream. See man
128+
systemd.socket for format. Default is unset.
129+
130+
`libvirt_host_tls_server_cert`: TLS server certificate. Default is unset.
131+
132+
`libvirt_host_tls_server_key`: TLS server key. Default is unset.
133+
134+
`libvirt_host_tls_client_cert`: TLS client certificate. Default is unset.
135+
136+
`libvirt_host_tls_client_key`: TLS client key. Default is unset.
137+
138+
`libvirt_host_tls_cacert`: TLS CA certificate. Default is unset.
139+
118140
Dependencies
119141
------------
120142

‎defaults/main.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,3 +83,19 @@ libvirt_host_libvirtd_conf: {}
8383
libvirt_host_qemu_conf_enabled: true
8484
# Configuration for qemu.conf. Dict mapping option names to values.
8585
libvirt_host_qemu_conf: {}
86+
87+
# Whether to enable the systemd TCP socket unit.
88+
libvirt_host_tcp_listen: false
89+
# Systemd TCP socket ListenStream. See man systemd.socket for format.
90+
libvirt_host_tcp_listen_address:
91+
92+
# Whether to enable the systemd TLS socket unit.
93+
libvirt_host_tls_listen: false
94+
# Systemd TLS socket ListenStream. See man systemd.socket for format.
95+
libvirt_host_tls_listen_address:
96+
# TLS server and client certificates.
97+
libvirt_host_tls_server_cert:
98+
libvirt_host_tls_server_key:
99+
libvirt_host_tls_client_cert:
100+
libvirt_host_tls_client_key:
101+
libvirt_host_tls_cacert:

‎handlers/main.yml‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,34 @@
11
---
22

3-
- name: restart libvirt
3+
- name: reload systemd
4+
systemd:
5+
daemon_reload: true
6+
become: true
7+
8+
# The socket units cannot be stopped or started if libvirt is running.
9+
- name: stop libvirt
10+
service:
11+
name: libvirtd
12+
state: stopped
13+
become: true
14+
listen:
15+
- restart libvirt
16+
17+
- name: start libvirtd sockets
18+
service:
19+
name: "{{ item.service }}"
20+
state: "{{ item.enabled | bool | ternary('started', 'stopped') }}"
21+
become: true
22+
loop: "{{ _libvirt_socket_services }}"
23+
loop_control:
24+
label: "{{ item.service }}"
25+
listen:
26+
- restart libvirt
27+
28+
- name: start libvirt
429
service:
530
name: libvirtd
6-
state: restarted
31+
state: started
732
become: true
833

934
- name: reload libvirt qemu apparmor profile template

‎tasks/config.yml‎

Lines changed: 86 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,95 @@
4343
notify:
4444
- restart libvirt
4545

46+
- name: Create systemd drop-in directory for socket listen address
47+
file:
48+
path: "/etc/systemd/system/{{ item.service }}.d"
49+
state: directory
50+
owner: root
51+
group: root
52+
mode: 0755
53+
become: true
54+
loop: "{{ _libvirt_socket_services | selectattr('enabled') }}"
55+
when:
56+
- item.listen_address is not none
57+
- item.listen_address | length > 0
58+
loop_control:
59+
label: "{{ item.service }}"
60+
vars:
61+
_libvirt_listen_stream: "{{ item.listen_address }}"
62+
63+
- name: Configure socket listen address
64+
template:
65+
src: socket.j2
66+
dest: "/etc/systemd/system/{{ item.service }}.d/listen-address.conf"
67+
owner: root
68+
group: root
69+
mode: 0644
70+
become: true
71+
loop: "{{ _libvirt_socket_services | selectattr('enabled') }}"
72+
when:
73+
- item.listen_address is not none
74+
- item.listen_address | length > 0
75+
loop_control:
76+
label: "{{ item.service }}"
77+
vars:
78+
_libvirt_listen_stream: "{{ item.listen_address }}"
79+
notify:
80+
- reload systemd
81+
- restart libvirt
82+
83+
- name: Create directory for TLS certificates and keys
84+
file:
85+
path: "{{ item }}"
86+
state: directory
87+
owner: root
88+
group: root
89+
mode: 0700
90+
become: true
91+
loop: >-
92+
{{ _libvirt_tls_certs.values() |
93+
selectattr('content') |
94+
map(attribute='dest') |
95+
map('dirname') |
96+
unique }}
97+
when:
98+
- libvirt_host_tls_listen | bool
99+
100+
- name: Copy TLS certificates and keys
101+
copy:
102+
content: "{{ _libvirt_loop_item.content }}"
103+
dest: "{{ _libvirt_loop_item.dest }}"
104+
owner: root
105+
group: root
106+
mode: "{{ _libvirt_loop_item.mode }}"
107+
become: true
108+
# NOTE: Loop over keys of _libvirt_tls_certs to avoid leaking the key
109+
# contents.
110+
loop: "{{ _libvirt_tls_certs.keys() }}"
111+
when:
112+
- libvirt_host_tls_listen | bool
113+
- _libvirt_loop_item.content
114+
vars:
115+
_libvirt_loop_item: "{{ _libvirt_tls_certs[item] }}"
116+
notify: restart libvirt
117+
46118
- name: Flush handlers
47119
meta: flush_handlers
48120

49121
- name: Ensure the libvirt daemon is started and enabled
50122
service:
51-
name: libvirtd
52-
state: started
53-
enabled: yes
123+
name: "{{ item.service }}"
124+
state: "{{ item.enabled | bool | ternary('started', 'stopped') }}"
125+
enabled: "{{ item.enabled | bool }}"
54126
become: True
127+
loop: "{{ _libvirt_services }}"
128+
loop_control:
129+
label: "{{ item.service }}"
130+
vars:
131+
_libvirt_services:
132+
- service: libvirtd-tcp.socket
133+
enabled: "{{ libvirt_host_tcp_listen | bool }}"
134+
- service: libvirtd-tls.socket
135+
enabled: "{{ libvirt_host_tls_listen | bool }}"
136+
- service: libvirtd
137+
enabled: true

‎templates/socket.j2‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# {{ ansible_managed }}
2+
[Socket]
3+
ListenStream=
4+
ListenStream={{ _libvirt_listen_stream }}

‎vars/main.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
# List of socket services.
3+
_libvirt_socket_services:
4+
- service: libvirtd-tcp.socket
5+
enabled: "{{ libvirt_host_tcp_listen | bool }}"
6+
listen_address: "{{ libvirt_host_tcp_listen_address }}"
7+
- service: libvirtd-tls.socket
8+
enabled: "{{ libvirt_host_tls_listen | bool }}"
9+
listen_address: "{{ libvirt_host_tls_listen_address }}"
10+
11+
# List of TLS certificates.
12+
_libvirt_tls_certs:
13+
servercert:
14+
content: "{{ libvirt_host_tls_server_cert }}"
15+
dest: /etc/pki/libvirt/servercert.pem
16+
mode: "0600"
17+
serverkey:
18+
content: "{{ libvirt_host_tls_server_key }}"
19+
dest: /etc/pki/libvirt/private/serverkey.pem
20+
mode: "0600"
21+
clientcert:
22+
content: "{{ libvirt_host_tls_client_cert }}"
23+
dest: /etc/pki/libvirt/clientcert.pem
24+
mode: "0600"
25+
clientkey:
26+
content: "{{ libvirt_host_tls_client_key }}"
27+
dest: /etc/pki/libvirt/private/clientkey.pem
28+
mode: "0600"
29+
cacert:
30+
content: "{{ libvirt_host_tls_cacert }}"
31+
dest: /etc/pki/CA/cacert.pem
32+
mode: "0644"

0 commit comments

Comments
 (0)