5 Commits

Include renames

Author	SHA1	Message	Date
volker.raschekandCopilot	95ea71394e	fix: make issued certificates readable for unprivileged consumers ... The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed unreachable for every non root process although they are declared as 0644. That defeats the main purpose of the role, which is handing a certificate to a service such as nginx or postgres. The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	41d06e4e6d	feat!: apply subject alternative names to root and intermediate CA ... The variables `certificate_authority_root_ca_subject_alternative_names` and `certificate_authority_intermediate_ca_subject_alternative_names` were documented but never referenced by any task, so both CA certificates were always issued without SANs. Wire them into the corresponding CSR tasks and fall back to `omit` when the list is empty. SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed with `DNS:` by the role. This allows other types such as `IP:` or `email:`, which the previous rewrite would have corrupted into values like `DNS:IP:...`. The client tasks additionally dropped `join(',') | quote`, because `quote` performs shell escaping and `openssl_csr` expects a list. Since both client CSR tasks only differed in `subject_alt_name`, they collapse into a single task per file. BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now carry their type prefix, for example `DNS:example.local` instead of `example.local`. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:28:52 +02:00
volker.raschek	ef2c31e64e	fix: remove state	2025-07-31 19:08:10 +02:00
volker.raschek	1c40b1d59b	feat: support further TLS certification properties	2025-07-31 18:46:19 +02:00
volker.raschek	a0ea59c528	Initial Commit	2025-07-30 22:09:38 +02:00