Support mesos with SSL enabled (#43)

* Support mesos with SSL enabled

* Prevent having an empty ssl.conf file

README.md

@@ -59,6 +59,12 @@ marathon_zookeeper_state: "zk://{{ zookeeper_hostnames }}{{ marathon_zookeeper_p
 # The path to install the haproxy configuration script. If this is an empty string ```""``` haproxy configuration will be disabled.
 haproxy_script_location: "/usr/local/bin"
 
+# **Mesos** SSL support
+mesos_ssl_enabled: false # When mesos has SSL enabled, set to true and fill in other `mesos_ssl_` variables.
+mesos_ssl_support_downgrade: false
+mesos_ssl_key_file: # When mesos SSL is enabled this must be used to point to the SSL key file
+mesos_ssl_cert_file: # When mesos SSL is enabled this must be used to point to the SSL certificate file
+
 # optional
 artifact_store: ""
 checkpoint: "true"

defaults/main.yml

@@ -32,6 +32,10 @@ marathon_zookeeper_state: "zk://{{ zookeeper_hostnames }}{{ marathon_zookeeper_p
 # The path to install the haproxy configuration script. If this is an empty string ```""``` haproxy configuration will be disabled.
 haproxy_script_location: "/usr/local/bin"
 
+# SSL
+mesos_ssl_enabled: false
+mesos_ssl_support_downgrade: false
+
 # optional
 artifact_store: ""
 checkpoint: "true"

handlers/main.yml

@@ -1,4 +1,8 @@
 ---
+- name: Reload systemd
+  command: systemctl daemon-reload
+  when: ansible_service_mgr == 'systemd'
+
 - name: Restart marathon
   service: name=marathon state=restarted
 

tasks/main.yml

@@ -20,5 +20,29 @@
   tags:
     - haproxy
 
+- name: Make sure service dropin directory is available
+  file:
+    path: /etc/systemd/system/marathon.service.d/
+    state: directory
+  when: ansible_service_mgr == 'systemd'
+
+- name: Add SSL settings/environment variables
+  template:
+    src: ssl.conf.j2
+    dest: /etc/systemd/system/marathon.service.d/ssl.conf
+  when: ansible_service_mgr == 'systemd' and mesos_ssl_enabled
+  notify:
+  - Reload systemd
+  - Restart marathon
+
+- name: Remove SSL settings/environment variables
+  file:
+    path: /etc/systemd/system/marathon.service.d/ssl.conf
+    state: absent
+  when: ansible_service_mgr == 'systemd' and not mesos_ssl_enabled
+  notify:
+  - Reload systemd
+  - Restart marathon
+
 - name: Enable Marathon service
   service: name=marathon enabled=yes

templates/ssl.conf.j2

@@ -0,0 +1,5 @@
+[Service]
+Environment="LIBPROCESS_SSL_ENABLED=true"
+Environment="LIBPROCESS_SSL_SUPPORT_DOWNGRADE={{ mesos_ssl_support_downgrade | ternary('true', 'false')}}"
+Environment="LIBPROCESS_SSL_KEY_FILE={{ mesos_ssl_key_file }}"
+Environment="LIBPROCESS_SSL_CERT_FILE={{ mesos_ssl_cert_file }}"