New role for ipareplica installation

The support for external cert files is not complete yet.

Please have a look at the example inventory file inventory/hosts.replica and
also the install and uninstall playbook files install-replica.yml and
uninstall-replica.yml

install-replica.yml

+---
+- name: Playbook to configure IPA replicas
+  hosts: ipareplicas
+  become: true
+
+  roles:
+  - role: ipareplica
+    state: present

inventory/hosts.replica

+[ipaservers]
+ipaserver.test.local
+
+[ipareplicas]
+ipareplica1.test.local
+
+[ipareplicas:vars]
+ipaadmin_password=password1
+ipadm_password=password1
+ipaclient_force_join=yes

roles/ipareplica/defaults/main.yml

+---
+# defaults file for ipareplica
+
+### basic ###
+ipareplica_no_host_dns: no
+ipareplica_skip_conncheck: no
+### server ###
+ipareplica_setup_adtrust: no
+ipareplica_setup_ca: no
+ipareplica_setup_kra: no
+ipareplica_setup_dns: no
+ipareplica_no_pkinit: no
+ipareplica_no_ui_redirect: no
+### client ###
+ipaclient_mkhomedir: no
+ipaclient_force_join: no
+ipaclient_no_ntp: no
+#ipaclient_ssh_trust_dns: no
+#ipaclient_no_ssh: no
+#ipaclient_no_sshd: no
+#ipaclient_no_dns_sshfp: no
+### certificate system ###
+ipareplica_skip_schema_check: no
+### dns ###
+ipareplica_allow_zone_overlap: no
+ipareplica_no_reverse: no
+ipareplica_auto_reverse: no
+ipareplica_no_forwarders: no
+ipareplica_auto_forwarders: no
+ipareplica_no_dnssec_validation: no
+### ad trust ###
+ipareplica_add_sids: no
+ipareplica_add_agents: no
+ipareplica_enable_compat: no
+### uninstall ###
+ipareplica_ignore_topology_disconnect: no
+ipareplica_ignore_last_of_role: no
+### additional ###
+ipareplica_no_package_install: no
+ipareplica_no_firewalld: no

roles/ipareplica/files/py3test.py

+#!/usr/bin/python3
+
+# Test ipaerver python3 binding
+from ipaserver.install.server.replicainstall import install_check
+
+# Check ipapython version to be >= 4.6
+from ipapython.version import NUM_VERSION, VERSION
+if NUM_VERSION < 40590:
+    raise Exception("ipa %s not usable with python3" % VERSION)

roles/ipareplica/library/ipareplica_add_to_ipaservers.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_add_to_ipaservers
+short description: Add to ipaservers
+description:
+  Add to ipaservers
+options:
+  setup_kra:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  installer_ccache:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            ### server ###
+            setup_kra=dict(required=True, type='bool'),
+            ### additional ###
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            installer_ccache=dict(required=True),
+            _top_dir = dict(required=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    ### additional ###
+    config_master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    options._ccache = ansible_module.params.get('installer_ccache')
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    options._top_dir = ansible_module.params.get('_top_dir')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALLER ==")
+
+    options = installer
+    promote = installer.promote
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    #config = gen_ReplicaConfig()
+
+    remote_api = gen_remote_api(config_master_host_name, paths.ETC_IPA)
+    #installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    ansible_log.debug("-- HOSTGROUP_ADD_MEMBER --")
+    try:
+        ansible_log.debug("-- CONNECT --")
+        conn.connect(ccache=installer._ccache)
+        remote_api.Command['hostgroup_add_member'](
+            u'ipaservers',
+            host=[unicode(api.env.host)],
+        )
+    finally:
+        if conn.isconnected():
+            ansible_log.debug("-- DISCONNECT --")
+            conn.disconnect()
+        os.environ['KRB5CCNAME'] = ccache
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_create_ipa_conf.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_create_ipa_conf
+short description: Create ipa.conf
+description:
+  Create ipa.conf
+options:
+  dm_password:
+    description: Directory Manager password
+    required: yes
+  password:
+    description: Admin user kerberos password
+    required: yes
+  ip_addresses:
+    description: List of Master Server IP Addresses
+    required: no
+  domain:
+    description: Primary DNS domain of the IPA deployment
+    required: yes
+  realm:
+    description: Kerberos realm name of the IPA deployment
+    required: yes
+  hostname:
+    description: Fully qualified name of this host
+    required: yes
+  ca_cert_files:
+    description: List of iles containing CA certificates for the service certificate files
+    required: yes
+  no_host_dns:
+    description: Do not use DNS for hostname lookup during installation
+    required: yes
+  setup_adtrust:
+    description: 
+    required: yes
+  setup_ca:
+    description: 
+    required: yes
+  setup_kra:
+    description: 
+    required: yes
+  setup_dns:
+    description: 
+    required: yes
+  dirserv_cert_files:
+    description: 
+    required: yes
+  force_join:
+    description: 
+    required: yes
+  subject_base:
+    description: 
+    required: yes
+  server:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  installer_ccache:
+    description: 
+    required: yes
+  _ca_enabled:
+    description: 
+    required: yes
+  _kra_enabled:
+    description: 
+    required: yes
+  _dirsrv_pkcs12_info:
+    description: 
+    required: yes
+  _http_pkcs12_info:
+    description: 
+    required: yes
+  _pkinit_pkcs12_info:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  _add_to_ipaservers:
+    description: 
+    required: yes
+  _ca_subject:
+    description: 
+    required: yes
+  _subject_base:
+    description: 
+    required: yes
+  dirman_password:
+    description: 
+    required: yes
+  config_setup_ca:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+  config_ca_host_name:
+    description: 
+    required: yes
+  config_ips:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            ### basic ###
+            dm_password=dict(required=False, no_log=True),
+            password=dict(required=False, no_log=True),
+            ip_addresses=dict(required=False, type='list', default=[]),
+            domain=dict(required=False),
+            realm=dict(required=False),
+            hostname=dict(required=False),
+            ca_cert_files=dict(required=False, type='list', default=[]),
+            no_host_dns=dict(required=False, type='bool', default=False),
+            ### server ###
+            setup_adtrust=dict(required=False, type='bool'),
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            setup_dns=dict(required=False, type='bool'),
+            ### ssl certificate ###
+            dirsrv_cert_files=dict(required=False, type='list', default=[]),
+            ### client ###
+            force_join=dict(required=False, type='bool'),
+            ### certificate system ###
+            subject_base=dict(required=True),
+            ### additional ###
+            server=dict(required=True),
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            installer_ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _kra_enabled=dict(required=False, type='bool'),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _http_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            _add_to_ipaservers = dict(required=True),
+            _ca_subject=dict(required=True),
+            _subject_base=dict(required=True),
+
+            dirman_password=dict(required=True, no_log=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    options.dm_password = ansible_module.params.get('dm_password')
+    options.password = options.dm_password
+    options.admin_password = ansible_module.params.get('password')
+    options.ip_addresses = ansible_module_get_parsed_ip_addresses(
+        ansible_module)
+    options.domain_name = ansible_module.params.get('domain')
+    options.realm_name = ansible_module.params.get('realm')
+    options.host_name = ansible_module.params.get('hostname')
+    options.ca_cert_files = ansible_module.params.get('ca_cert_files')
+    options.no_host_dns = ansible_module.params.get('no_host_dns')
+    ### server ###
+    options.setup_adtrust = ansible_module.params.get('setup_adtrust')
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.setup_dns = ansible_module.params.get('setup_dns')
+    ### ssl certificate ###
+    options.dirsrv_cert_files = ansible_module.params.get('dirsrv_cert_files')
+    ### client ###
+    options.force_join = ansible_module.params.get('force_join')
+    ### certificate system ###
+    options.external_ca = ansible_module.params.get('external_ca')
+    options.external_cert_files = ansible_module.params.get(
+        'external_cert_files')
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    options.ca_subject = ansible_module.params.get('ca_subject')
+    ### dns ###
+    options.reverse_zones = ansible_module.params.get('reverse_zones')
+    options.no_reverse = ansible_module.params.get('no_reverse')
+    options.auto_reverse = ansible_module.params.get('auto_reverse')
+    options.forwarders = ansible_module.params.get('forwarders')
+    options.no_forwarders = ansible_module.params.get('no_forwarders')
+    options.auto_forwarders = ansible_module.params.get('auto_forwarders')
+    options.forward_policy = ansible_module.params.get('forward_policy')
+
+    ### additional ###
+    #options._host_name_overridden = ansible_module.params.get(
+    #    '_hostname_overridden')
+    options.server = ansible_module.params.get('server')
+    master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    kra_enabled = ansible_module.params.get('_kra_enabled')
+
+    dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    http_pkcs12_info = ansible_module.params.get('_http_pkcs12_info')
+    pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    options._top_dir = ansible_module.params.get('_top_dir')
+    options._add_to_ipaservers = ansible_module.params.get('_add_to_ipaservers')
+
+    options._ca_subject = ansible_module.params.get('_ca_subject')
+    options._subject_base = ansible_module.params.get('_subject_base')
+
+    dirman_password = ansible_module.params.get('dirman_password')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    # prepare (install prepare, install checks) #
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.subject_base = options.subject_base
+    config.dirman_password = dirman_password
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    cafile = paths.IPA_CA_CRT
+
+    if promote:
+        ansible_log.debug("-- CREATE_IPA_CONF --")
+        # Create the management framework config file. Do this irregardless
+        # of the state of DS installation. Even if it fails,
+        # we need to have master-like configuration in order to perform a
+        # successful uninstallation
+        # The configuration creation has to be here otherwise previous call
+        # To config certmonger would try to connect to local server
+        create_ipa_conf(fstore, config, ca_enabled)
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_custodia_import_dm_password.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_custodia_import_dm_password
+short description: Import dm password into custodia
+description:
+  Import dm password into custodia
+options:
+  setup_ca:
+    description: 
+    required: yes
+  setup_kra:
+    description: 
+    required: yes
+  no_pkinit:
+    description: 
+    required: yes
+  no_ui_redirect:
+    description: 
+    required: yes
+  subject_base:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  _ca_enabled:
+    description: 
+    required: yes
+  _ca_file:
+    description: 
+    required: yes
+  _dirsrv_pkcs12_info:
+    description: 
+    required: yes
+  _pkinit_pkcs12_info:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  dirman_password:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            #### server ###
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            no_pkinit=dict(required=False, type='bool'),
+            no_ui_redirect=dict(required=False, type='bool'),
+            #### certificate system ###
+            subject_base=dict(required=True),
+            #### additional ###
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _ca_file=dict(required=False),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.no_pkinit = ansible_module.params.get('no_pkinit')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    #installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options._top_dir = ansible_module.params.get('_top_dir')
+    dirman_password = ansible_module.params.get('dirman_password')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.subject_base = options.subject_base
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    # do the work #
+
+    with redirect_stdout(ansible_log):
+        custodia = custodiainstance.CustodiaInstance(config.host_name,
+                                                     config.realm_name)
+
+        ansible_log.debug("-- CUSTODIA IMPORT DM PASSWORD --")
+
+        custodia.import_dm_password(config.master_host_name)
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_ds_apply_updates.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_ds_apply_updates
+short description: DS apply updates
+description:
+  DS apply updates
+options:
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            #### server ###
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            no_pkinit=dict(required=False, type='bool'),
+            no_ui_redirect=dict(required=False, type='bool'),
+            dirsrv_config_file=dict(required=False),
+            #### certificate system ###
+            subject_base=dict(required=True),
+            #### additional ###
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _ca_file=dict(required=False),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+            ds_ca_subject=dict(required=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.no_pkinit = ansible_module.params.get('no_pkinit')
+    options.dirsrv_config_file = ansible_module.params.get('dirsrv_config_file')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    #installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    installer._dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    installer._pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options._top_dir = ansible_module.params.get('_top_dir')
+    dirman_password = ansible_module.params.get('dirman_password')
+    ds_ca_subject = ansible_module.params.get('ds_ca_subject')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.dirman_password = dirman_password
+    config.subject_base = options.subject_base
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    #installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    # There is a api.Backend.ldap2.connect call somewhere in ca, ds, dns or
+    # ntpinstance 
+    api.Backend.ldap2.connect()
+    conn.connect(ccache=ccache)
+
+    cafile = paths.IPA_CA_CRT
+    with redirect_stdout(ansible_log):
+        ds = replica_ds_init_info(ansible_log,
+                                  config, options, ca_enabled,
+                                  remote_api, ds_ca_subject,
+                                  ca_file=paths.IPA_CA_CRT,
+                                  promote=promote,
+                                  pkcs12_info=installer._dirsrv_pkcs12_info)
+
+        ansible_log.debug("-- DS APPLY_UPDATES --")
+
+        # Apply any LDAP updates. Needs to be done after the replica is
+        # synced-up
+        #service.print_msg("Applying LDAP updates")
+        #ds.apply_updates()
+        schema_files = dsinstance.get_all_external_schema_files(
+            paths.EXTERNAL_SCHEMA_DIR)
+        data_upgrade = upgradeinstance.IPAUpgrade(ds.realm,
+                                                  schema_files=schema_files)
+        data_upgrade.set_output(ansible_log)
+        try:
+            data_upgrade.create_instance()
+        except Exception as e:
+            # very fatal errors only will raise exception
+            raise RuntimeError("Update failed: %s" % e)
+        installutils.store_version()
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_ds_enable_ssl.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_ds_enable_ssl
+short description: DS enable SSL
+description:
+  DS enable SSL
+options:
+  setup_ca:
+    description: 
+    required: yes
+  setup_kra:
+    description: 
+    required: yes
+  no_pkinit:
+    description: 
+    required: yes
+  subject_base:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  _ca_enabled:
+    description: 
+    required: yes
+  _ca_file:
+    description: 
+    required: yes
+  _dirsrv_pkcs12_info:
+    description: 
+    required: yes
+  _pkinit_pkcs12_info:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  dirman_password:
+    description: 
+    required: yes
+  ds_ca_subject:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            #### server ###
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            no_pkinit=dict(required=False, type='bool'),
+            dirsrv_config_file=dict(required=False),
+            #### certificate system ###
+            subject_base=dict(required=True),
+            #### additional ###
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _ca_file=dict(required=False),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+            ds_ca_subject=dict(required=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.no_pkinit = ansible_module.params.get('no_pkinit')
+    options.dirsrv_config_file = ansible_module.params.get('dirsrv_config_file')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    #installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    options._dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    options._pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options._top_dir = ansible_module.params.get('_top_dir')
+    dirman_password = ansible_module.params.get('dirman_password')
+    ds_ca_subject = ansible_module.params.get('ds_ca_subject')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.dirman_password = dirman_password
+    config.subject_base = options.subject_base
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    #installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    # There is a api.Backend.ldap2.connect call somewhere in ca, ds, dns or
+    # ntpinstance
+    api.Backend.ldap2.connect()
+    conn.connect(ccache=ccache)
+
+    with redirect_stdout(ansible_log):
+        ds = replica_ds_init_info(ansible_log,
+                                  config, options, ca_enabled,
+                                  remote_api, ds_ca_subject,
+                                  ca_file=paths.IPA_CA_CRT,
+                                  promote=promote,
+                                  pkcs12_info=installer._dirsrv_pkcs12_info)
+
+        ansible_log.debug("-- DS.ENABLE_SSL --")
+
+        # we now need to enable ssl on the ds
+        ds.enable_ssl()
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_install_ca_certs.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_install_ca_cert
+short description: Install CA certs
+description:
+  Install CA certs
+options:
+  dm_password:
+    description: Directory Manager password
+    required: yes
+  password:
+    description: Admin user kerberos password
+    required: yes
+  ip_addresses:
+    description: List of Master Server IP Addresses
+    required: no
+  domain:
+    description: Primary DNS domain of the IPA deployment
+    required: yes
+  realm:
+    description: Kerberos realm name of the IPA deployment
+    required: yes
+  hostname:
+    description: Fully qualified name of this host
+    required: yes
+  ca_cert_files:
+    description: List of iles containing CA certificates for the service certificate files
+    required: yes
+  no_host_dns:
+    description: Do not use DNS for hostname lookup during installation
+    required: yes
+  setup_adtrust:
+    description: 
+    required: yes
+  setup_kra:
+    description: 
+    required: yes
+  setup_dns:
+    description: 
+    required: yes
+  external_ca:
+    description: 
+    required: yes
+  external_cert_files:
+    description: 
+    required: yes
+  subject_base:
+    description: 
+    required: yes
+  ca_subject:
+    description: 
+    required: yes
+  reverse_zones:
+    description: 
+    required: yes
+  no_reverse:
+    description: 
+    required: yes
+  auto_reverse:
+    description: 
+    required: yes
+  forwarders:
+    description: 
+    required: yes
+  no_forwarders:
+    description: 
+    required: yes
+G  auto_forwarders:
+    description: 
+    required: yes
+  forward_policy:
+    description: 
+    required: yes
+  enable_compat:
+    description: 
+    required: yes
+  netbios_name:
+    description: 
+    required: yes
+  rid_base:
+    description: 
+    required: yes
+  secondary_rid_base:
+    description: 
+    required: yes
+  setup_ca:
+    description: 
+    required: yes
+  _hostname_overridden:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            ### basic ###
+            dm_password=dict(required=False, no_log=True),
+            password=dict(required=False, no_log=True),
+            ip_addresses=dict(required=False, type='list', default=[]),
+            domain=dict(required=False),
+            realm=dict(required=False),
+            hostname=dict(required=False),
+            ca_cert_files=dict(required=False, type='list', default=[]),
+            no_host_dns=dict(required=False, type='bool', default=False),
+            ### server ###
+            setup_adtrust=dict(required=False, type='bool'),
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            setup_dns=dict(required=False, type='bool'),
+            ### ssl certificate ###
+            dirsrv_cert_files=dict(required=False, type='list', default=[]),
+            ### client ###
+            force_join=dict(required=False, type='bool'),
+            ### certificate system ###
+            subject_base=dict(required=True),
+            ### additional ###
+            server=dict(required=True),
+            ccache=dict(required=True),
+            installer_ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _kra_enabled=dict(required=False, type='bool'),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _http_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            _add_to_ipaservers = dict(required=True),
+            _ca_subject=dict(required=True),
+            _subject_base=dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+            config_setup_ca=dict(required=True),
+            config_master_host_name=dict(required=True),
+            config_ca_host_name=dict(required=True),
+            config_ips=dict(required=False, type='list', default=[]),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### basic ###
+    options.dm_password = ansible_module.params.get('dm_password')
+    options.password = options.dm_password
+    options.admin_password = ansible_module.params.get('password')
+    options.ip_addresses = ansible_module_get_parsed_ip_addresses(
+        ansible_module)
+    options.domain_name = ansible_module.params.get('domain')
+    options.realm_name = ansible_module.params.get('realm')
+    options.host_name = ansible_module.params.get('hostname')
+    options.ca_cert_files = ansible_module.params.get('ca_cert_files')
+    options.no_host_dns = ansible_module.params.get('no_host_dns')
+    ### server ###
+    options.setup_adtrust = ansible_module.params.get('setup_adtrust')
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.setup_dns = ansible_module.params.get('setup_dns')
+    ### ssl certificate ###
+    options.dirsrv_cert_files = ansible_module.params.get('dirsrv_cert_files')
+    ### client ###
+    options.force_join = ansible_module.params.get('force_join')
+    ### certificate system ###
+    options.external_ca = ansible_module.params.get('external_ca')
+    options.external_cert_files = ansible_module.params.get(
+        'external_cert_files')
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    options.ca_subject = ansible_module.params.get('ca_subject')
+    ### dns ###
+    options.reverse_zones = ansible_module.params.get('reverse_zones')
+    options.no_reverse = ansible_module.params.get('no_reverse')
+    options.auto_reverse = ansible_module.params.get('auto_reverse')
+    options.forwarders = ansible_module.params.get('forwarders')
+    options.no_forwarders = ansible_module.params.get('no_forwarders')
+    options.auto_forwarders = ansible_module.params.get('auto_forwarders')
+    options.forward_policy = ansible_module.params.get('forward_policy')
+    ### additional ###
+    options.server = ansible_module.params.get('server')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    kra_enabled = ansible_module.params.get('_kra_enabled')
+    dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    http_pkcs12_info = ansible_module.params.get('_http_pkcs12_info')
+    pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    options._top_dir = ansible_module.params.get('_top_dir')
+    options._add_to_ipaservers = ansible_module.params.get('_add_to_ipaservers')
+    options._ca_subject = ansible_module.params.get('_ca_subject')
+    options._subject_base = ansible_module.params.get('_subject_base')
+    dirman_password = ansible_module.params.get('dirman_password')
+    config_setup_ca = ansible_module.params.get('config_setup_ca')
+    config_master_host_name = ansible_module.params.get('config_master_host_name')
+    config_ca_host_name = ansible_module.params.get('config_ca_host_name')
+    config_ips = ansible_module_get_parsed_ip_addresses(ansible_module,
+                                                        "config_ips")
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALLER ==")
+
+    options = installer
+    promote = installer.promote
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.dirman_password = dirman_password
+    config.setup_ca = config_setup_ca
+    config.master_host_name = config_master_host_name
+    config.ca_host_name = config_ca_host_name
+    config.ips = config_ips
+
+    remote_api = gen_remote_api(config.master_host_name, paths.ETC_IPA)
+    installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    cafile = paths.IPA_CA_CRT
+    with redirect_stdout(ansible_log):
+        try:
+            ansible_log.debug("-- CONNECT --")
+            if promote:
+                conn.connect(ccache=ccache)
+            else:
+                # dmlvl 0 replica install should always use DM credentials
+                # to create remote LDAP connection. Since ACIs permitting hosts
+                # to manage their own services were added in 4.2 release,
+                # the master denies this operations.
+                conn.connect(bind_dn=ipaldap.DIRMAN_DN, cacert=cafile,
+                             bind_pw=dirman_password)
+
+            ansible_log.debug("-- INSTALL_CA_CERT --")
+            # Update and istall updated CA file
+            cafile = install_ca_cert(conn, api.env.basedn, api.env.realm, cafile)
+            install_ca_cert(conn, api.env.basedn, api.env.realm, cafile,
+                            destfile=paths.KDC_CA_BUNDLE_PEM)
+            install_ca_cert(conn, api.env.basedn, api.env.realm, cafile,
+                            destfile=paths.CA_BUNDLE_PEM)
+
+        finally:
+            if conn.isconnected():
+                ansible_log.debug("-- DISCONNECT --")
+                conn.disconnect()
+
+    # done #
+
+    ansible_module.exit_json(changed=True,
+                             config_master_host_name=config.master_host_name,
+                             config_ca_host_name=config.ca_host_name)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_krb_enable_ssl.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_krb_enable_ssl
+short description: KRB enable SSL
+description:
+  KRB enable SSL
+options:
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            #### server ###
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            no_pkinit=dict(required=False, type='bool'),
+            #### certificate system ###
+            subject_base=dict(required=True),
+            #### additional ###
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _ca_file=dict(required=False),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.no_pkinit = ansible_module.params.get('no_pkinit')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    #installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    options._pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options._top_dir = ansible_module.params.get('_top_dir')
+    dirman_password = ansible_module.params.get('dirman_password')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.dirman_password = dirman_password
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    #installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    # There is a api.Backend.ldap2.connect call somewhere in ca, ds, dns or
+    # ntpinstance
+    api.Backend.ldap2.connect()
+    conn.connect(ccache=ccache)
+
+    # krb
+    krb = krbinstance.KrbInstance(fstore)
+    krb.set_output(ansible_log)
+    with redirect_stdout(ansible_log):
+        krb.init_info(api.env.realm, api.env.host,
+                      setup_pkinit=not options.no_pkinit,
+                      subject_base=options.subject_base)
+
+        ansible_log.debug("-- KRB ENABLE_SSL --")
+
+        # configure PKINIT now that all required services are in place
+        krb.enable_ssl()
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_promote_openldap_conf.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_promote_openldap_conf
+short description: Promote openldap.conf
+description:
+  Promote openldap.conf
+options:
+  setup_kra:
+    description: 
+    required: no
+  subject_base:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  config_setup_ca:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            ### server ###
+            setup_kra=dict(required=False, type='bool'),
+            ### certificate system ###
+            subject_base=dict(required=True),
+            ### additional ###
+            ccache=dict(required=True),
+            _top_dir = dict(required=True),
+            config_setup_ca=dict(required=True),
+            config_master_host_name=dict(required=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    options._top_dir = ansible_module.params.get('_top_dir')
+    config_setup_ca = ansible_module.params.get('config_setup_ca')
+    installer.setup_ca = config_setup_ca
+    config_master_host_name = ansible_module.params.get('config_master_host_name')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+
+    ansible_log.debug("== INSTALL ==")
+
+    promote = installer.promote
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.subject_base = options.subject_base
+    config.setup_ca = config_setup_ca
+    config.master_host_name = config_master_host_name
+
+    remote_api = gen_remote_api(config.master_host_name, paths.ETC_IPA)
+    installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    with redirect_stdout(ansible_log):
+        ansible_log.debug("-- PROMOTE OPENLDAP_CONF--")
+
+        promote_openldap_conf(config.host_name, config.master_host_name)
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_promote_sssd.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_promote_sssd
+short description: Promote sssd
+description:
+  Promote sssd
+options:
+  setup_kra:
+    description: 
+    required: no
+  subject_base:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  config_setup_ca:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            ### server ###
+            setup_kra=dict(required=False, type='bool'),
+            ### certificate system ###
+            subject_base=dict(required=True),
+            ### additional ###
+            ccache=dict(required=True),
+            _top_dir = dict(required=True),
+            config_setup_ca=dict(required=True),
+            config_master_host_name=dict(required=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    options._top_dir = ansible_module.params.get('_top_dir')
+    config_setup_ca = ansible_module.params.get('config_setup_ca')
+    installer.setup_ca = config_setup_ca
+    config_master_host_name = ansible_module.params.get('config_master_host_name')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    promote = installer.promote
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.subject_base = options.subject_base
+    config.setup_ca = config_setup_ca
+    config.master_host_name = config_master_host_name
+
+    remote_api = gen_remote_api(config.master_host_name, paths.ETC_IPA)
+    installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    with redirect_stdout(ansible_log):
+        ansible_log.debug("-- PROMOTE SSSD --")
+
+        promote_sssd(config.host_name)
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_restart_kdc.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_restart_kdc
+short description: Restart KDC
+description:
+  Restart KDC
+options:
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            #### server ###
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            no_pkinit=dict(required=False, type='bool'),
+            no_ui_redirect=dict(required=False, type='bool'),
+            #### certificate system ###
+            subject_base=dict(required=True),
+            #### additional ###
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _ca_file=dict(required=False),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.no_pkinit = ansible_module.params.get('no_pkinit')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    #installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options._top_dir = ansible_module.params.get('_top_dir')
+    dirman_password = ansible_module.params.get('dirman_password')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.dirman_password = dirman_password
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    #installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    # There is a api.Backend.ldap2.connect call somewhere in ca, ds, dns or
+    # ntpinstance
+    api.Backend.ldap2.connect()
+    conn.connect(ccache=ccache)
+
+    # krb
+    krb = krbinstance.KrbInstance(fstore)
+    krb.set_output(ansible_log)
+    with redirect_stdout(ansible_log):
+        krb.init_info(api.env.realm, api.env.host,
+                      setup_pkinit=not options.no_pkinit,
+                      subject_base=options.subject_base)
+
+        ansible_log.debug("-- RESTART KDC --")
+
+        service.print_msg("Restarting the KDC")
+        krb.restart()
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_setup_adtrust.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_setup_adtrust
+short description: Setup adtrust
+description:
+  Setup adtrust
+options:
+  setup_adtrust:
+    description: 
+    required: yes
+  setup_kra:
+    description: 
+    required: yes
+  subject_base:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  config_setup_ca:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            ### server ###
+            setup_adtrust=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            ### certificate system ###
+            subject_base=dict(required=True),
+            ### additional ###
+            ccache=dict(required=True),
+            _top_dir = dict(required=True),
+            config_setup_ca=dict(required=True),
+            config_master_host_name=dict(required=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_adtrust = ansible_module.params.get('setup_adtrust')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    options._top_dir = ansible_module.params.get('_top_dir')
+    config_setup_ca = ansible_module.params.get('config_setup_ca')
+    config_master_host_name = ansible_module.params.get('config_master_host_name')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.subject_base = options.subject_base
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    with redirect_stdout(ansible_log):
+        #if options.setup_adtrust:
+        ansible_log.debug("-- INSTALL ADTRUST --")
+
+        adtrust.install(False, options, fstore, api)
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_setup_ca.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_setup_ca
+short description: Setup CA
+description:
+  Setup CA
+options:
+  setup_ca:
+    description: 
+    required: yes
+  setup_kra:
+    description: 
+    required: yes
+  no_pkinit:
+    description: 
+    required: yes
+  no_ui_redirect:
+    description: 
+    required: yes
+  subject_base:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  _ca_enabled:
+    description: 
+    required: yes
+  _ca_file:
+    description: 
+    required: yes
+  _dirsrv_pkcs12_info:
+    description: 
+    required: yes
+  _pkinit_pkcs12_info:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  _ca_subject:
+    description: 
+    required: yes
+  _subject_base:
+    description: 
+    required: yes
+  dirman_password:
+    description: 
+    required: yes
+  config_setup_ca:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+  config_ca_host_name:
+    description: 
+    required: yes
+  config_ips:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            #### server ###
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            no_pkinit=dict(required=False, type='bool'),
+            no_ui_redirect=dict(required=False, type='bool'),
+            #### certificate system ###
+            subject_base=dict(required=True),
+            #### additional ###
+            ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _ca_file=dict(required=False),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            _ca_subject=dict(required=True),
+            _subject_base=dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+            config_setup_ca=dict(required=True),
+            config_master_host_name=dict(required=True),
+            config_ca_host_name=dict(required=True),
+            config_ips=dict(required=False, type='list', default=[]),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.no_pkinit = ansible_module.params.get('no_pkinit')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    #installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    installer._dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    installer._pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options._top_dir = ansible_module.params.get('_top_dir')
+    options._ca_subject = ansible_module.params.get('_ca_subject')
+    if options._ca_subject is not None:
+        options._ca_subject = DN(options._ca_subject)
+    options._subject_base = ansible_module.params.get('_subject_base')
+    if options._subject_base is not None:
+        options._subject_base = DN(options._subject_base)
+    dirman_password = ansible_module.params.get('dirman_password')
+    config_setup_ca = ansible_module.params.get('config_setup_ca')
+    config_master_host_name = ansible_module.params.get('config_master_host_name')
+    config_ca_host_name = ansible_module.params.get('config_ca_host_name')
+    config_ips = ansible_module_get_parsed_ip_addresses(ansible_module,
+                                                        "config_ips")
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+
+    config = gen_ReplicaConfig()
+    config.dirman_password = dirman_password
+    config.setup_ca = config_setup_ca
+    config.master_host_name = config_master_host_name
+    config.ca_host_name = config_ca_host_name
+    config.ips = config_ips
+
+    remote_api = gen_remote_api(config.master_host_name, paths.ETC_IPA)
+    options._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    # There is a api.Backend.ldap2.connect call somewhere in ca, ds, dns or
+    # ntpinstance
+    api.Backend.ldap2.connect()
+    #conn.connect(ccache=ccache)
+
+    ansible_log.debug("-- INSTALL CA --")
+
+    with redirect_stdout(ansible_log):
+        options.realm_name = config.realm_name
+        options.domain_name = config.domain_name
+        options.host_name = config.host_name
+        options.dm_password = config.dirman_password
+        ca.install(False, config, options)
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_setup_certmonger.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_setup_certmonger
+short description: Setup certmonger
+description:
+  Setup certmonger
+options:
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+
+    with redirect_stdout(ansible_log):
+        ansible_log.debug("-- CONFIGURE_CERTMONGER --")
+
+        # FIXME: allow to use passed in certs instead
+        configure_certmonger()
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()

roles/ipareplica/library/ipareplica_setup_custodia.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-replica-install code
+#
+# Copyright (C) 2018  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import print_function
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipareplica_setup_custodia
+short description: Setup custodia
+description:
+  Setup custodia
+options:
+  setup_ca:
+    description: 
+    required: yes
+  setup_kra:
+    description: 
+    required: yes
+  no_pkinit:
+    description: 
+    required: yes
+  no_ui_redirect:
+    description: 
+    required: yes
+  subject_base:
+    description: 
+    required: yes
+  config_master_host_name:
+    description: 
+    required: yes
+  ccache:
+    description: 
+    required: yes
+  _ca_enabled:
+    description: 
+    required: yes
+  _ca_file:
+    description: 
+    required: yes
+  _top_dir:
+    description: 
+    required: yes
+  dirman_password:
+    description: 
+    required: yes
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.ansible_ipa_replica import *
+
+def main():
+    ansible_module = AnsibleModule(
+        argument_spec = dict(
+            #### server ###
+            setup_ca=dict(required=False, type='bool'),
+            setup_kra=dict(required=False, type='bool'),
+            no_pkinit=dict(required=False, type='bool'),
+            no_ui_redirect=dict(required=False, type='bool'),
+            #### certificate system ###
+            subject_base=dict(required=True),
+            #### additional ###
+            config_master_host_name=dict(required=True),
+            ccache=dict(required=True),
+            _ca_enabled=dict(required=False, type='bool'),
+            _ca_file=dict(required=False),
+            _dirsrv_pkcs12_info = dict(required=False),
+            _pkinit_pkcs12_info = dict(required=False),
+            _top_dir = dict(required=True),
+            dirman_password=dict(required=True, no_log=True),
+        ),
+        supports_check_mode = True,
+    )
+
+    ansible_module._ansible_debug = True
+    ansible_log = AnsibleModuleLog(ansible_module)
+
+    # get parameters #
+
+    options = installer
+    ### server ###
+    options.setup_ca = ansible_module.params.get('setup_ca')
+    options.setup_kra = ansible_module.params.get('setup_kra')
+    options.no_pkinit = ansible_module.params.get('no_pkinit')
+    ### certificate system ###
+    options.subject_base = ansible_module.params.get('subject_base')
+    if options.subject_base is not None:
+        options.subject_base = DN(options.subject_base)
+    ### additional ###
+    master_host_name = ansible_module.params.get('config_master_host_name')
+    ccache = ansible_module.params.get('ccache')
+    os.environ['KRB5CCNAME'] = ccache
+    #os.environ['KRB5CCNAME'] = ansible_module.params.get('installer_ccache')
+    #installer._ccache = ansible_module.params.get('installer_ccache')
+    ca_enabled = ansible_module.params.get('_ca_enabled')
+    dirsrv_pkcs12_info = ansible_module.params.get('_dirsrv_pkcs12_info')
+    options._pkinit_pkcs12_info = ansible_module.params.get('_pkinit_pkcs12_info')
+    options._top_dir = ansible_module.params.get('_top_dir')
+    dirman_password = ansible_module.params.get('dirman_password')
+
+    # init #
+
+    fstore = sysrestore.FileStore(paths.SYSRESTORE)
+    sstore = sysrestore.StateFile(paths.SYSRESTORE)
+
+    ansible_log.debug("== INSTALL ==")
+
+    options = installer
+    promote = installer.promote
+    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
+
+    env = gen_env_boostrap_finalize_core(paths.ETC_IPA,
+                                         constants.DEFAULT_CONFIG)
+    api_bootstrap_finalize(env)
+    config = gen_ReplicaConfig()
+    config.dirman_password = dirman_password
+
+    remote_api = gen_remote_api(master_host_name, paths.ETC_IPA)
+    #installer._remote_api = remote_api
+
+    conn = remote_api.Backend.ldap2
+    ccache = os.environ['KRB5CCNAME']
+
+    # There is a api.Backend.ldap2.connect call somewhere in ca, ds, dns or
+    # ntpinstance
+    api.Backend.ldap2.connect()
+    conn.connect(ccache=ccache)
+
+    with redirect_stdout(ansible_log):
+        ansible_log.debug("-- INSTALL_CUSTODIA --")
+
+        custodia = custodiainstance.CustodiaInstance(config.host_name,
+                                                     config.realm_name)
+        if promote:
+            ansible_log.debug("-- CUSTODIA CREATE_REPLICA --")
+            custodia.create_replica(config.master_host_name)
+        else:
+            ansible_log.debug("-- CUSTODIA CREATE_INSTANCE --")
+            custodia.create_instance()
+
+    # done #
+
+    ansible_module.exit_json(changed=True)
+
+if __name__ == '__main__':
+    main()