roles: add socat as a TLS endpoint

Author: cejkato2

ansible/inventory/host_files/list-vagrant/socat/tls-endpoint.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Create a simple TLS endpoint using socat and keys&certs in /etc/tls-enspoint/ (server.key,server.crt,sa.crt)
+After=network-online.target
+Before=multi-user.target
+DefaultDependencies=no
+
+[Service]
+User=tlsendpoint
+
+ExecStart=/bin/socat openssl-listen:4740,method=TLS1.2,key=/etc/tls-endpoint/server.key,cert=/etc/tls-endpoint/server.crt,cafile=/etc/tls-endpoint/ca.crt,reuseaddr,fork udp-sendto:localhost:4739
+
+# wait 60 seconds before trying to restart the connection
+# if it disconnects
+RestartSec=60
+
+# keep retrying no matter what
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+

ansible/list.yml

@@ -13,3 +13,4 @@
     - { role: warden-client, tags: warden-client }
     - { role: easyrsa, tags: easyrsa }
     - { role: fail2ban, tags: fail2ban }
+    - { role: socat, tags: socat }

ansible/roles/socat/tasks/install.yml

@@ -0,0 +1,40 @@
+- name: Check for TLS endpoint configuration (tls-endpoint.service)
+  local_action: stat path={{ tlsendpoint_service }}
+  become: false
+  register: tlsendpoint_service_file
+  ignore_errors: True
+
+- name: Install socat
+  yum: "name=socat state=installed"
+  when: tlsendpoint_service_file.stat.exists
+
+- name: Copy tls-endpoint.service configuration
+  copy:
+    src: "{{ tlsendpoint_service }}"
+    dest: /etc/systemd/system/tls-endpoint.service
+  when: tlsendpoint_service_file.stat.exists
+
+- name: Create a system user tlsendpoint
+  user:
+    name: tlsendpoint
+    system: yes
+    state: present
+    create_home: no
+  when: tlsendpoint_service_file.stat.exists
+
+- name: Create directory for TLS certificates
+  file:
+    path: /etc/tls-endpoint/
+    state: directory
+    owner: tlsendpoint
+  when: tlsendpoint_service_file.stat.exists
+
+- name: Create README for tlsendpoint
+  copy:
+    content: >
+      Put server.key, server.crt, ca.crt into this directory and execute
+      systemctl enable tlsendpoint
+      service tlsendpoint start
+    dest: /etc/tls-endpoint/README
+  when: tlsendpoint_service_file.stat.exists
+

ansible/roles/socat/tasks/main.yml

@@ -0,0 +1,4 @@
+- name: Socat install
+  include: install.yml
+  tags: install
+

ansible/roles/socat/vars/main.yml

@@ -0,0 +1,2 @@
+tlsendpoint_service: "{{ inventory_dir }}/host_files/{{ inventory_hostname }}/socat/tls-endpoint.service"
+