From 918f7c8fbfa5663703ad39c874ca629b17ddd9a3 Mon Sep 17 00:00:00 2001
From: Matej Focko <me@mfocko.xyz>
Date: Fri, 12 Jul 2024 15:01:52 +0200
Subject: [PATCH] feat(system/cockpit): implement Cockpit role

Signed-off-by: Matej Focko <me@mfocko.xyz>
---
 roles/system/cockpit/defaults/main.yml      |  5 +++++
 roles/system/cockpit/tasks/install.yml      |  5 +++++
 roles/system/cockpit/tasks/main.yml         | 19 +++++++++++++++++++
 roles/system/cockpit/templates/cockpit.conf |  3 +++
 4 files changed, 32 insertions(+)
 create mode 100644 roles/system/cockpit/defaults/main.yml
 create mode 100644 roles/system/cockpit/tasks/install.yml
 create mode 100644 roles/system/cockpit/tasks/main.yml
 create mode 100644 roles/system/cockpit/templates/cockpit.conf

diff --git a/roles/system/cockpit/defaults/main.yml b/roles/system/cockpit/defaults/main.yml
new file mode 100644
index 0000000..ee6f952
--- /dev/null
+++ b/roles/system/cockpit/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+# Boolean variable that adjust the Cockpit config when it's being served via
+# reverse proxy (adjusts the origin, so that the Cockpit doesn't drop sessions,
+# and checks for SSL/TLS connections)
+system_cockpit_has_reverse_proxy: false
diff --git a/roles/system/cockpit/tasks/install.yml b/roles/system/cockpit/tasks/install.yml
new file mode 100644
index 0000000..50e675e
--- /dev/null
+++ b/roles/system/cockpit/tasks/install.yml
@@ -0,0 +1,5 @@
+---
+- name: Install cockpit
+  ansible.builtin.package:
+    name: cockpit
+    state: present
diff --git a/roles/system/cockpit/tasks/main.yml b/roles/system/cockpit/tasks/main.yml
new file mode 100644
index 0000000..162a247
--- /dev/null
+++ b/roles/system/cockpit/tasks/main.yml
@@ -0,0 +1,19 @@
+---
+- name: Packages
+  ansible.builtin.include_tasks: install.yml
+  tags: install
+
+- name: Install config to enable reverse proxy
+  ansible.builtin.template:
+    src: templates/cockpit.conf
+    dest: /etc/cockpit/cockpit.conf
+    mode: 0644
+    owner: root
+    group: root
+  when: system_cockpit_has_reverse_proxy
+
+- name: Enable cockpit
+  ansible.builtin.service:
+    name: "cockpit.socket"
+    enabled: true
+    state: restarted
diff --git a/roles/system/cockpit/templates/cockpit.conf b/roles/system/cockpit/templates/cockpit.conf
new file mode 100644
index 0000000..710c26c
--- /dev/null
+++ b/roles/system/cockpit/templates/cockpit.conf
@@ -0,0 +1,3 @@
+[WebService]
+Origins = https://cockpit.{{ host_fqdn }} wss://cockpit.{{ host_fqdn }}
+ProtocolHeader = X-Forwarded-Proto