29.8. Using Ansible to install an IdM server with integrated eDNS and an integrated root CA

Procedure

1. Optional: To use a custom PEM-formatted certificate and key for DoT issued by an external certificate authority:

   1. SSH to the host where you are going to install the IdM server:

      $ ssh root@server.idm.example.com

   2. Create the two files and assign ownership to the named daemon:

      # openssl req \
        -newkey rsa:2048 \
        -nodes \
        -keyout /etc/pki/tls/certs/privkey.pem \
        -x509 \
        -days 36500 \
        -out /etc/pki/tls/certs/certificate.pem \
        -subj "/C=<country_code>/ST=<state>/L=<location>/O=<organization>/OU=<organizational_unit>/CN=<idm_server_fqdn>/emailAddress=<email>" && \
        chown named:named /etc/pki/tls/certs/privkey.pem /etc/pki/tls/certs/certificate.pem

   3. Exit the SSH session on the IdM server:

      # exit

2. On the Ansible controller, create a playbook file named install-server-integrated-ca.yml with the instructions to install an IdM server with an integrated IdM CA:

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     vars:
       ipaserver_domain: idm.example.com
       ipaserver_realm: IDM.EXAMPLE.COM
       ipaserver_hostname: server.idm.example.com
       ipa_admin_password: "{{ vault_admin_password }}"
       ipadm_password: "{{ vault_dm_password }}"
       ipaserver_setup_dns: true
       ipaserver_dot_forwarders:
         - "<server_ip>#<dns_server_hostname>"
       ipaserver_dns_over_tls: true
       ipaserver_auto_reverse: true
   
     roles:
     - role: freeipa.ansible_freeipa.ipaserver

   If you are using a custom PEM-formatted certificate and key for DoT issued by an external certificate authority, add the following in the vars section:

   ipaserver_dns_over_tls_cert: /etc/pki/tls/certs/certificate.pem
   ipaserver_dns_over_tls_key: /etc/pki/tls/certs/privkey.pem

3. Run the Ansible playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-integrated-ca.yml

Troubleshooting

1. SSH to the IdM server:

   # ssh root@server.idm.example.com

2. Enable detailed logging for the unbound service:

   # unbound-control verbosity 3

3. Restart the unbound service to apply the updated configuration:

   # systemctl restart unbound

4. Monitor real-time logs of the unbound service:

   $ journalctl -u unbound -f