Merge branch 't39644-untrusted-apt-repo' into 'main'

Add option for untrusted APT repositories | refs #39644

See merge request sys/ansible-public!93

CHANGELOG.md

+# 2024-05-15
+
+Adding the "trusted" option for Debian and UbiCast repositories in the `system/repositories` role.
+The "trusted" option is configurable through the "repos_ubicast_trusted" and "repos_debian_trusted" new boolean variables (see role documentation and example inventories for more informations).
+
 # 2024-04-12
 
 * Adding a new paquet installation `ubicast-web-access` when installing `nudgis/front`, `nudgis/manager` or `nudgis/monitor/server` in an online deployment. This package manages the magic login on the portal for UbiCast empoyees when maintenances are needed.

inventories/example/ha/group_vars/repository.yml

@@ -6,4 +6,7 @@
 # Domain to use for the Debian security repositories
 #repos_debian_security_packages_domain: "security.debian.org"
 
+# Check the Debian apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_debian_trusted: false
+
 ...
\ No newline at end of file

inventories/example/ha/host_vars/ha-cel.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-db1.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-db2.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-dbw.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-live1.yml

@@ -52,6 +52,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-live2.yml

@@ -52,6 +52,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-misc1.yml

@@ -76,6 +76,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-mm.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-ms1.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-ms2.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-mw1.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/ha/host_vars/ha-mw2.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/std/group_vars/repository.yml

@@ -6,4 +6,7 @@
 # Domain to use for the Debian security repositories
 #repos_debian_security_packages_domain: "security.debian.org"
 
+# Check the Debian apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_debian_trusted: false
+
 ...
\ No newline at end of file

inventories/example/std/host_vars/std-misc1.yml

@@ -76,6 +76,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/std/host_vars/std-ms1.yml

@@ -52,6 +52,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

inventories/example/std/host_vars/std-mw1.yml

@@ -48,6 +48,10 @@ repos_ubicast_packages_domain: "manager.ubica.st"
 #   UbiCast repository token used to make API call to mirismanager.ubicast.net to retrieve system informations
 repos_ubicast_packages_token: "UBICAST-APT-TOKEN"
 
+# repository:
+#   Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+#repos_ubicast_trusted: false
+
 # user:
 #   Password for the system user admin
 sysuser_admin_password: "my-password"

roles/system/repository/README.md

@@ -27,6 +27,11 @@ repos_ubicast_packages_token: "XXXX-XXXX-XXXX-XXXX-XXXX"
 repos_ubicast_packages_domain: "manager.example.com"
 ```
 
+`repos_ubicast_trusted`: Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+```
+repos_ubicast_trusted: false
+```
+
 `repos_debian_packages_domain`: Domain to use for the Debian repositories (Optional)
 ```
 repos_debian_packages_domain: "deb.debian.org"
@@ -36,3 +41,8 @@ repos_debian_packages_domain: "deb.debian.org"
 ```
 repos_debian_security_packages_domain: "security.debian.org"
 ```
+
+`repos_debian_trusted`: Check the Debian apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+```
+repos_debian_trusted: false
+```

roles/system/repository/defaults/main.yml

@@ -12,10 +12,16 @@ repos_ubicast_packages_token: "XXXX-XXXX-XXXX-XXXX-XXXX"
 # Domain of the UbiCast debian packages repository URL
 repos_ubicast_packages_domain: "manager.example.com"
 
+# Check the UbiCast apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+repos_ubicast_trusted: false
+
 # Domain to use for the Debian repositories
 repos_debian_packages_domain: "deb.debian.org"
 
 # Domain to use for the Debian security repositories
 repos_debian_security_packages_domain: "security.debian.org"
 
+# Check the Debian apt repository SSL certificate (if "true" the repository is trusted and there is no verification)
+repos_debian_trusted: false
+
 ...