fix: update the systems trust store from a handler

The update command ran on every play with changed_when tied to its return code, so the role never
reported a converged state. It is a handler now, notified by the anchor symlink and by the three tasks
which write cert.pem of the root certificate authority. Notifying from the certificate tasks as well keeps
the trust store correct on renewal, where the symlink itself stays untouched.

The anchor path and the update command moved into the per os_family vars, because a handler cannot read
the block vars they lived in before. Debian and RedHat need dedicated files again, they agree on the
package name but differ in anchor path, file extension and update command.

Co-authored-by: Copilot <copilot@github.com>

handlers/main.yaml

@@ -0,0 +1,8 @@
+---
+
+- name: Update systems SSL/TLS trust store
+  ansible.builtin.command:
+    cmd: "{{ certificate_authority_trust_store_update_command }}"
+  changed_when: true
+  when: certificate_authority_root_ca_import is defined and
+        certificate_authority_root_ca_import

tasks/root_certificate_authority.yaml

@@ -47,29 +47,12 @@
     _concat_mode: "0600"
 
 - name: Import certificate of root Certificate Authority (CA) into systems trust store
-  vars:
+  ansible.builtin.file:
-    # Debian based distributions only consider anchors with the file extension crt.
+    src: "{{ certificate_authority_root_ca_path }}/cert.pem"
-    _trust_store_anchor:
+    dest: "{{ certificate_authority_trust_store_anchor }}"
-      Archlinux: "/etc/ca-certificates/trust-source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
+    owner: root
-      Debian: "/usr/local/share/ca-certificates/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.crt"
+    group: root
-      RedHat: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
+    state: link
-    _trust_store_update_command:
+  notify: Update systems SSL/TLS trust store
-      Archlinux: "/usr/bin/update-ca-trust"
-      Debian: "/usr/sbin/update-ca-certificates"
-      RedHat: "/usr/bin/update-ca-trust"
   when: certificate_authority_root_ca_import is defined and
         certificate_authority_root_ca_import
-  block:
-  - name: Create symolic link
-    ansible.builtin.file:
-      src: "{{ certificate_authority_root_ca_path }}/cert.pem"
-      dest: "{{ _trust_store_anchor[ansible_facts['os_family']] }}"
-      owner: root
-      group: root
-      state: link
-  - name: Update systems SSL/TLS trust store
-    ansible.builtin.command:
-      cmd: "{{ _trust_store_update_command[ansible_facts['os_family']] }}"
-    register: _update_ca_trust
-    changed_when: _update_ca_trust.rc == 0
-    failed_when: _update_ca_trust.rc > 0

tasks/root_certificate_authority_import.yaml

@@ -16,4 +16,5 @@
     owner: "root"
     group: "root"
     mode: "0644"
+  notify: Update systems SSL/TLS trust store
   when: certificate_authority_root_ca_tls_crt_content | length > 0

tasks/root_certificate_authority_protected.yaml

@@ -33,3 +33,4 @@
     provider: selfsigned
     selfsigned_not_after: "{{ certificate_authority_root_ca_not_after }}"
     selfsigned_not_before: "{{ certificate_authority_root_ca_not_before }}"
+  notify: Update systems SSL/TLS trust store

tasks/root_certificate_authority_unprotected.yaml

@@ -29,3 +29,4 @@
     provider: selfsigned
     selfsigned_not_after: "{{ certificate_authority_root_ca_not_after }}"
     selfsigned_not_before: "{{ certificate_authority_root_ca_not_before }}"
+  notify: Update systems SSL/TLS trust store

vars/Archlinux.yaml

@@ -2,3 +2,6 @@
 
 certificate_authority_python_packages:
 - python-cryptography
+
+certificate_authority_trust_store_anchor: "/etc/ca-certificates/trust-source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
+certificate_authority_trust_store_update_command: "/usr/bin/update-ca-trust"

vars/Debian.yaml

@@ -0,0 +1,8 @@
+---
+
+certificate_authority_python_packages:
+- python3-cryptography
+
+# Debian based distributions only consider anchors with the file extension crt.
+certificate_authority_trust_store_anchor: "/usr/local/share/ca-certificates/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.crt"
+certificate_authority_trust_store_update_command: "/usr/sbin/update-ca-certificates"

vars/RedHat.yaml

@@ -0,0 +1,7 @@
+---
+
+certificate_authority_python_packages:
+- python3-cryptography
+
+certificate_authority_trust_store_anchor: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
+certificate_authority_trust_store_update_command: "/usr/bin/update-ca-trust"