diff --git a/README.md b/README.md index f649ce4c..fbf425c2 100644 --- a/README.md +++ b/README.md @@ -45,6 +45,7 @@ Below is the list of variables you can redefine in your playbook to customize st | `st2_auth_username` | `testu` | Username used by StackStorm standalone authentication. | `st2_auth_password` | `testp` | Password used by StackStorm standalone authentication. | `st2_save_credentials` | `yes` | Save credentials for local CLI in `/root/.st2/config` file. +| `st2_datastore_key` | `null` | String for the datastore key file contents. This is useful if you're deploying StackStorm to multiple nodes and they need to share the same datastore key. By default, this variable is undefined and a new random key will be generated for each node. | `st2_packs` | `[ st2 ]` | List of packs to install. This flag does not work with a `--python3` only pack. | `st2_python_packages` | `[ ]` | List of python packages to install into the `/opt/stackstorm/st2` virtualenv. This is needed when deploying alternative auth or coordination backends which depend on Python modules to make them work. | **st2web** diff --git a/roles/StackStorm.st2/defaults/main.yml b/roles/StackStorm.st2/defaults/main.yml index 521b9007..068fa49a 100644 --- a/roles/StackStorm.st2/defaults/main.yml +++ b/roles/StackStorm.st2/defaults/main.yml @@ -34,6 +34,11 @@ st2_auth_username: testu st2_auth_password: testp # Save credentials in ~/.st2/config file st2_save_credentials: yes +# The string contents of the datastore key file. If you need to distribute the same key +# to multiple StackStorm nodes, generate a datastore key and populate this variable +# when installing on each of the ndoes. +# Example: '{"hmacKey": {"hmacKeyString": "xxx", "size": 256}, "aesKeyString": "yyy", "mode": "CBC", "size": 256}' +st2_datastore_key: null # ST2 packs to be installed (list) st2_packs: - st2 diff --git a/roles/StackStorm.st2/tasks/datastore.yml b/roles/StackStorm.st2/tasks/datastore.yml index e2610d2a..57f84273 100644 --- a/roles/StackStorm.st2/tasks/datastore.yml +++ b/roles/StackStorm.st2/tasks/datastore.yml @@ -13,6 +13,16 @@ command: st2-generate-symmetric-crypto-key --key-path {{ st2_datastore_key_file }} args: creates: "{{ st2_datastore_key_file }}" + when: not st2_datastore_key + notify: restart st2 + +- name: Copy st2 encryption key + become: yes + copy: + content: "{{ st2_datastore_key }}" + dest: "{{ st2_datastore_key_file }}" + when: st2_datastore_key + notify: restart st2 - name: Fix permissions on datastore encryption key become: yes @@ -29,4 +39,4 @@ section: keyvalue option: encryption_key_path value: "{{ st2_datastore_key_file }}" - notify: restart st2api + notify: restart st2