refactor: extract the duplicated certificate concatenation into a shared task file

Building chain.pem, fullchain.pem and all.pem was implemented seven times across three task files with
identical stat, awk and copy tasks. The blocks now include tasks/concatenate.yaml and pass the sources, the
destination and the mode, which removes about a hundred lines.

Two side effects come with it. Every source file is checked instead of only the foreign one, so a missing
file skips the block instead of letting awk fail. And the trailing newline of the result is kept, because
stdout_lines joined by a newline dropped it.

Co-authored-by: Copilot <copilot@github.com>

tasks/client_certificate.yaml

@@ -45,82 +45,28 @@
         not certificate_authority_client_create
 
 - name: Create certificate chain file
-  block:
+  ansible.builtin.include_tasks: concatenate.yaml
-  - name: Check if intermediate certificate exists
-    ansible.builtin.stat:
-      path: "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
-    register: _stat_result
-  - name: Concatenate client certificate and intermediate certificate
   vars:
-      _chain_files:
+    _concat_sources:
     - "{{ certificate_authority_client_path }}/cert.pem"
     - "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
-    ansible.builtin.command:
+    _concat_dest: "{{ certificate_authority_client_path }}/chain.pem"
-      cmd: awk 1 {{ _chain_files | join(' ') }}
+    _concat_mode: "0644"
-    register: chain_content
-    changed_when: false
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
-  - name: Create concatenated chain file
-    ansible.builtin.copy:
-      content: "{{ chain_content.stdout_lines | join('\n') }}"
-      dest: "{{ certificate_authority_client_path }}/chain.pem"
-      owner: "root"
-      group: "root"
-      mode: "0644"
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
 
 - name: Create certificate fullchain file
-  block:
+  ansible.builtin.include_tasks: concatenate.yaml
-  - name: Check if intermediate chain exists
-    ansible.builtin.stat:
-      path: "{{ certificate_authority_intermediate_ca_path }}/chain.pem"
-    register: _stat_result
-  - name: Concatenate client certificate and intermediate chain file
   vars:
-      _chain_files:
+    _concat_sources:
     - "{{ certificate_authority_client_path }}/cert.pem"
     - "{{ certificate_authority_intermediate_ca_path }}/chain.pem"
-    ansible.builtin.command:
+    _concat_dest: "{{ certificate_authority_client_path }}/fullchain.pem"
-      cmd: awk 1 {{ _chain_files | join(' ') }}
+    _concat_mode: "0644"
-    register: chain_content
-    changed_when: false
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
-  - name: Create concatenated fullchain file
-    ansible.builtin.copy:
-      content: "{{ chain_content.stdout_lines | join('\n') }}"
-      dest: "{{ certificate_authority_client_path }}/fullchain.pem"
-      owner: "root"
-      group: "root"
-      mode: "0644"
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
 
 - name: Create file with private key and fullchain file of the client
-  block:
+  ansible.builtin.include_tasks: concatenate.yaml
-  - name: Check if fullchain exists
-    ansible.builtin.stat:
-      path: "{{ certificate_authority_client_path }}/fullchain.pem"
-    register: _stat_result
-  - name: Concatenate private key and fullchain file of the client
   vars:
-      _chain_files:
+    _concat_sources:
     - "{{ certificate_authority_client_path }}/privkey.pem"
     - "{{ certificate_authority_client_path }}/fullchain.pem"
-    ansible.builtin.command:
+    _concat_dest: "{{ certificate_authority_client_path }}/all.pem"
-      cmd: awk 1 {{ _chain_files | join(' ') }}
+    _concat_mode: "0600"
-    register: chain_content
-    changed_when: false
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
-  - name: Create concatenated file
-    ansible.builtin.copy:
-      content: "{{ chain_content.stdout_lines | join('\n') }}"
-      dest: "{{ certificate_authority_client_path }}/all.pem"
-      owner: "root"
-      group: "root"
-      mode: "0600"
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists

tasks/concatenate.yaml

@@ -0,0 +1,24 @@
+---
+
+# awk 1 prints every line and thereby normalizes source files whose last line lacks a newline.
+- name: Check the source files of {{ _concat_dest }}
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  register: _concat_stat
+  loop: "{{ _concat_sources }}"
+
+- name: Read the source files of {{ _concat_dest }}
+  ansible.builtin.command:
+    cmd: "awk 1 {{ _concat_sources | join(' ') }}"
+  register: _concat_content
+  changed_when: false
+  when: _concat_stat.results | rejectattr('stat.exists') | list | length == 0
+
+- name: Write {{ _concat_dest }}
+  ansible.builtin.copy:
+    content: "{{ _concat_content.stdout }}\n"
+    dest: "{{ _concat_dest }}"
+    owner: "root"
+    group: "root"
+    mode: "{{ _concat_mode }}"
+  when: _concat_content is not skipped

tasks/intermediate_certificate_authority.yaml

@@ -45,82 +45,28 @@
         not certificate_authority_intermediate_ca_create
 
 - name: Create certificate chain file
-  block:
+  ansible.builtin.include_tasks: concatenate.yaml
-  - name: Check if root certificate exists
-    ansible.builtin.stat:
-      path: "{{ certificate_authority_root_ca_path }}/cert.pem"
-    register: _stat_result
-  - name: Concatenate intermediate certificate and root certificate
   vars:
-      _chain_files:
+    _concat_sources:
     - "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
     - "{{ certificate_authority_root_ca_path }}/cert.pem"
-    ansible.builtin.command:
+    _concat_dest: "{{ certificate_authority_intermediate_ca_path }}/chain.pem"
-      cmd: awk 1 {{ _chain_files | join(' ') }}
+    _concat_mode: "0644"
-    register: chain_content
-    changed_when: false
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
-  - name: Create concatenated chain file
-    ansible.builtin.copy:
-      content: "{{ chain_content.stdout_lines | join('\n') }}"
-      dest: "{{ certificate_authority_intermediate_ca_path }}/chain.pem"
-      owner: "root"
-      group: "root"
-      mode: "0644"
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
 
 - name: Create certificate fullchain file
-  block:
+  ansible.builtin.include_tasks: concatenate.yaml
-  - name: Check if root chain exists
-    ansible.builtin.stat:
-      path: "{{ certificate_authority_root_ca_path }}/chain.pem"
-    register: _stat_result
-  - name: Concatenate intermediate certificate and root chain file
   vars:
-      _chain_files:
+    _concat_sources:
     - "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
     - "{{ certificate_authority_root_ca_path }}/chain.pem"
-    ansible.builtin.command:
+    _concat_dest: "{{ certificate_authority_intermediate_ca_path }}/fullchain.pem"
-      cmd: awk 1 {{ _chain_files | join(' ') }}
+    _concat_mode: "0644"
-    register: chain_content
-    changed_when: false
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
-  - name: Create concatenated fullchain file
-    ansible.builtin.copy:
-      content: "{{ chain_content.stdout_lines | join('\n') }}"
-      dest: "{{ certificate_authority_intermediate_ca_path }}/fullchain.pem"
-      owner: "root"
-      group: "root"
-      mode: "0644"
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
 
 - name: Create file with private key and fullchain file of intermediate Certificate Authority (CA)
-  block:
+  ansible.builtin.include_tasks: concatenate.yaml
-  - name: Check if private key exists
-    ansible.builtin.stat:
-      path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem"
-    register: _stat_result
-  - name: Concatenate private key and fullchain file of intermediate Certificate Authority (CA)
   vars:
-      _chain_files:
+    _concat_sources:
     - "{{ certificate_authority_intermediate_ca_path }}/privkey.pem"
     - "{{ certificate_authority_intermediate_ca_path }}/fullchain.pem"
-    ansible.builtin.command:
+    _concat_dest: "{{ certificate_authority_intermediate_ca_path }}/all.pem"
-      cmd: awk 1 {{ _chain_files | join(' ') }}
+    _concat_mode: "0600"
-    register: chain_content
-    changed_when: false
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
-  - name: Create concatenated file
-    ansible.builtin.copy:
-      content: "{{ chain_content.stdout_lines | join('\n') }}"
-      dest: "{{ certificate_authority_intermediate_ca_path }}/all.pem"
-      owner: "root"
-      group: "root"
-      mode: "0600"
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists

tasks/root_certificate_authority.yaml

@@ -38,31 +38,13 @@
   - fullchain.pem
 
 - name: Create file with private key and fullchain file of root Certificate Authority (CA)
-  block:
+  ansible.builtin.include_tasks: concatenate.yaml
-  - name: Check if private key exists
-    ansible.builtin.stat:
-      path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
-    register: _stat_result
-  - name: Concatenate private key and fullchain file of root Certificate Authority (CA)
   vars:
-      _chain_files:
+    _concat_sources:
     - "{{ certificate_authority_root_ca_path }}/privkey.pem"
     - "{{ certificate_authority_root_ca_path }}/fullchain.pem"
-    ansible.builtin.command:
+    _concat_dest: "{{ certificate_authority_root_ca_path }}/all.pem"
-      cmd: awk 1 {{ _chain_files | join(' ') }}
+    _concat_mode: "0600"
-    register: chain_content
-    changed_when: false
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
-  - name: Create concatenated file
-    ansible.builtin.copy:
-      content: "{{ chain_content.stdout_lines | join('\n') }}"
-      dest: "{{ certificate_authority_root_ca_path }}/all.pem"
-      owner: "root"
-      group: "root"
-      mode: "0600"
-    when: _stat_result.stat.exists is defined and
-          _stat_result.stat.exists
 
 - name: Import certificate of root Certificate Authority (CA) into systems trust store
   vars: