6 Commits

Include renames

Author	SHA1	Message	Date
volker.raschekandCopilot	95ea71394e	fix: make issued certificates readable for unprivileged consumers ... The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed unreachable for every non root process although they are declared as 0644. That defeats the main purpose of the role, which is handing a certificate to a service such as nginx or postgres. The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	2cd88df81b	fix: report concatenation commands as unchanged ... The `awk 1` commands assembling the chain, fullchain and all files declared `changed_when: chain_content.rc == 0`, which holds on every successful run. As a result the role never reported a converged state, even when no certificate was touched. These commands only read files and write to stdout, so mark them as unchanged. The subsequent copy task remains responsible for reporting an actual change. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	a6e647b842	refactor: drop ineffective remote_src from copy tasks ... All tasks writing the concatenated chain, fullchain and all files pass the file body via `content`. The `remote_src` option only governs how `src` is resolved and is ignored in that case, so it merely suggested a behaviour the tasks never had. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	9ea26dc23f	fix: resolve trust store location per distribution family ... The trust store import hardcoded the RHEL anchor directory and `update-ca-trust`, although `meta/main.yaml` also declares ArchLinux and Ubuntu as supported platforms. On those distributions the task created a dangling symlink outside any trust source and then failed on the missing binary. Resolve both the anchor path and the update command from a map keyed by `ansible_facts['os_family']`. Debian based systems additionally require the file extension `crt`, because `update-ca-certificates` ignores anchors named otherwise. Note that the role now depends on gathered facts. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschek	dbbaacdc69	fix(root_ca): set passphrase correctly	2025-07-31 09:49:12 +02:00
volker.raschek	a0ea59c528	Initial Commit	2025-07-30 22:09:38 +02:00