2025-06-26-13-33-49: Cronjob

roles/lmn_wlan/tasks/eap-tls_check-certificate.yaml

@@ -0,0 +1,53 @@
+---
+#  WPA-Enterprise (EAP-TLS) - Check if certificate needs to be re-enrolled
+- name: Check if certificate is already active on client
+  ansible.builtin.stat:
+    path: "/etc/ssl/certs/{{ wlan_ssid }}.crt"
+  register: cert_client_active
+
+- name: Extract serial from certificate
+  ansible.builtin.command: 'openssl x509 -noout -serial -in /etc/ssl/certs/{{ wlan_ssid }}.crt'
+  changed_when: false
+  register: cert_serial
+  when: cert_client_active.stat.exists
+
+- name: Download crl from radius-server
+  ansible.builtin.get_url:
+    force: true
+    mode: "0644"
+    url: "{{ wlan_eap_ca_crl }}"
+    dest: /tmp/radius-ca.crl
+  when: cert_client_active.stat.exists
+
+- name: Get radius-server ca crl
+  community.crypto.x509_crl_info:
+    path: /tmp/radius-ca.crl
+    list_revoked_certificates: true
+  register: radius_crl
+  when: cert_client_active.stat.exists
+
+- name: Check if radius-server is reachable
+  ansible.builtin.command: echo "reachable"
+  delegate_to: radius_server
+  register: radius_reachable
+  changed_when: false
+  ignore_unreachable: true
+
+- name: Inform that radius_server is unreachable
+  ansible.builtin.debug:
+    msg:
+      - "Couldn't access radius_server. Possible reasons"
+      - "* server not reachable"
+      - "* no matching ssh-key"
+  changed_when: true
+  when: radius_reachable.stdout is not defined or radius_reachable.stdout!='reachable'
+
+- name: Issue radius certificate
+  ansible.builtin.include_tasks: eap-tls_issue-certificate.yaml
+  when:
+    - radius_reachable.stdout is defined and radius_reachable.stdout=="reachable"
+    - not run_in_installer|default(false)|bool
+    - |
+      ( not cert_client_active.stat.exists ) or
+      (cert_serial.stdout | replace('serial=','') | int(base=16) ) in ( radius_crl.revoked_certificates | map(attribute='serial_number') | list ) or
+      wlan_force_issue

roles/lmn_wlan/tasks/eap-tls_issue-certificate.yaml

@@ -0,0 +1,113 @@
+---
+#  WPA-Enterprise (EAP-TLS) - (re-)enroll certificate on client
+- name: Create private key for client certificate
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/{{ wlan_ssid }}.key
+
+- name: Check if a certificate is already issued to client
+  ansible.builtin.stat:
+    path: "/etc/freeradius/3.0/certs/issued/{{ ansible_hostname }}.crt"
+  register: cert_already_issued
+  delegate_to: radius_server
+
+- name: Revoke already existing client certificate
+  community.crypto.x509_crl:
+    path: "/etc/freeradius/3.0/certs/ca.crl"
+    privatekey_path: "/etc/freeradius/3.0/certs/ca.key"
+    privatekey_passphrase: "{{ wlan_eap_ca.password }}"
+    crl_mode: "update"
+    issuer:
+      C: "{{ wlan_eap_ca.C }}"
+      ST: "{{ wlan_eap_ca.ST }}"
+      L: "{{ wlan_eap_ca.L }}"
+      O: "{{ wlan_eap_ca.O }}"
+      emailAddress: "{{ wlan_eap_ca.emailAddress }}"
+      CN: "{{ wlan_eap_ca.CN }}"
+    last_update: "+0s"
+    next_update: "+365d"
+    revoked_certificates:
+      - path: "/etc/freeradius/3.0/certs/issued/{{ ansible_hostname }}.crt"
+        revocation_date: "{{ ansible_date_time.iso8601_basic_short | replace('T', '') }}Z"
+        reason: "unspecified"
+  delegate_to: radius_server
+  when: cert_already_issued.stat.exists
+
+- name: Create CSR for client certificate
+  community.crypto.openssl_csr_pipe:
+    common_name: "{{ ansible_hostname }}"
+    country_name: "{{ wlan_eap_ca.C }}"
+    state_or_province_name: "{{ wlan_eap_ca.ST }}"
+    locality_name: "{{ wlan_eap_ca.L }}"
+    organization_name: "{{ wlan_eap_ca.O }}"
+    privatekey_path: /etc/ssl/private/{{ wlan_ssid }}.key
+    email_address: "{{ wlan_eap_ca.emailAddress }}"
+  register: csr
+
+- name: Sign CSR on Radius
+  community.crypto.x509_certificate_pipe:
+    csr_content: "{{ csr.csr }}"
+    provider: ownca
+    ownca_path: /etc/freeradius/3.0/certs/ca.pem
+    ownca_privatekey_path: /etc/freeradius/3.0/certs/ca.key
+    ownca_privatekey_passphrase: "{{ wlan_eap_ca.password }}"
+    ownca_not_after: +1825d # 5 Years
+  delegate_to: radius_server
+  register: certificate
+
+- name: Create issued-Notice folder on radius-server
+  ansible.builtin.file:
+    dest: "/etc/freeradius/3.0/certs/issued"
+    state: directory
+    mode: '0755'
+  delegate_to: radius_server
+
+- name: Copy client certificate to radius-server
+  ansible.builtin.copy:
+    dest: "/etc/freeradius/3.0/certs/issued/{{ ansible_hostname }}.crt"
+    mode: "0644"
+    content: "{{ certificate.certificate }}"
+  delegate_to: radius_server
+
+- name: Write certificate to client
+  ansible.builtin.copy:
+    dest: /etc/ssl/certs/{{ wlan_ssid }}.crt
+    mode: '0644'
+    content: "{{ certificate.certificate }}"
+
+- name: Check if NetworkManager config exists {{ wlan_ssid }}
+  ansible.builtin.stat:
+    path: /etc/NetworkManager/system-connections/{{ wlan_ssid }}.nmconnection
+  register: nm_connection
+
+- name: Create or modify connection via nmcli {{ wlan_ssid }}
+  ansible.builtin.command: >
+    nmcli c {% if nm_connection.stat.exists %} modify {{ wlan_ssid }} {% else %} add {% endif %}
+    type wifi
+    ifname {{ ansible_interfaces | select('search', 'wl.+') | first }}
+    con-name "{{ wlan_ssid }}"
+    connection.permissions ""
+    802-11-wireless.ssid "{{ wlan_ssid }}"
+    802-11-wireless-security.key-mgmt wpa-eap
+    802-1x.eap tls
+    802-1x.identity {{ ansible_hostname }}
+    802-1x.client-cert /etc/ssl/certs/{{ wlan_ssid }}.crt
+    802-1x.private-key /etc/ssl/private/{{ wlan_ssid }}.key
+    802-1x.private-key-password dummy
+  changed_when: false
+
+# Temporary fix used to migrate from IWD to WPA-Supplicant - Will be removed later
+- name: Enable wpa-supplicant
+  ansible.builtin.systemd:
+    name: wpa_supplicant.service
+    enabled: true
+
+- name: Disable iwd
+  ansible.builtin.systemd:
+    name: iwd.service
+    enabled: false
+  failed_when: false
+
+- name: Remove deprecated NetworkManager config
+  ansible.builtin.blockinfile:
+    path: /etc/NetworkManager/NetworkManager.conf
+    state: absent

roles/lmn_wlan/tasks/main.yaml

@@ -0,0 +1,41 @@
+---
+# Setup requirements
+- name: Install packages related to wifi
+  ansible.builtin.apt:
+    name:
+      - firmware-realtek # for our wifi sticks
+
+- name: Provide service to enable WiFi on boot
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/enable-wifi.service
+    mode: '0644'
+    content: |
+      [Unit]
+      Description=Switch WiFi on
+      After=NetworkManager.service
+
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/bin/nmcli radio wifi on
+
+      [Install]
+      WantedBy=multi-user.target
+  when: wlan_enable_on_boot
+
+- name: Enable the enable-wifi service
+  ansible.builtin.systemd:
+    name: enable-wifi.service
+    enabled: true
+    daemon_reload: true
+  when: wlan_enable_on_boot
+
+# lmn_wlan - Initial configuration based on the WLAN variable
+# When WLAN type is set to PSK
+- name: Configure WPA-PSK
+  ansible.builtin.include_tasks: wpa-psk.yaml
+  when: wlan == 'psk'
+
+# When WLAN type is set to EAP-TLS (802.1x)
+- name: Configure WPA-Enterprise (EAP-TLS)
+  ansible.builtin.include_tasks: eap-tls_check-certificate.yaml
+  when: wlan == 'eap-tls'

roles/lmn_wlan/tasks/wpa-psk.yaml

@@ -0,0 +1,25 @@
+---
+# WPA-PSK - Configure SSID on client
+- name: Configure WLAN for devices
+  community.general.nmcli:
+    conn_name: "{{ wlan_ssid }}"
+    type: wifi
+    ssid: "{{ wlan_ssid }}"
+    ifname: "{{ ansible_interfaces | select('search', 'wl.+') | first }}"
+    wifi_sec:
+      key-mgmt: wpa-psk
+      psk: "{{ wlan_password }}"
+    autoconnect: true
+    state: present
+  when: |
+    not run_in_installer|default(false)|bool and
+    ansible_interfaces | select('search', 'wl.+') | first is defined
+
+- name: Provide WLAN config during installation
+  ansible.builtin.template:
+    src: ssid.nmconnection.j2
+    dest: "/etc/NetworkManager/system-connections/{{ wlan_ssid }}.nmconnection"
+    mode: '0600'
+  when: |
+    run_in_installer|default(false)|bool and
+    ansible_interfaces | select('search', 'wl.+') | first is defined