7 Commits

Include renames

Author	SHA1	Message	Date
volker.raschekandCopilot	95181a18d4	refactor: extract the duplicated certificate concatenation into a shared task file ... Building chain.pem, fullchain.pem and all.pem was implemented seven times across three task files with identical stat, awk and copy tasks. The blocks now include tasks/concatenate.yaml and pass the sources, the destination and the mode, which removes about a hundred lines. Two side effects come with it. Every source file is checked instead of only the foreign one, so a missing file skips the block instead of letting awk fail. And the trailing newline of the result is kept, because stdout_lines joined by a newline dropped it. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	95ea71394e	fix: make issued certificates readable for unprivileged consumers ... The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed unreachable for every non root process although they are declared as 0644. That defeats the main purpose of the role, which is handing a certificate to a service such as nginx or postgres. The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	2cd88df81b	fix: report concatenation commands as unchanged ... The `awk 1` commands assembling the chain, fullchain and all files declared `changed_when: chain_content.rc == 0`, which holds on every successful run. As a result the role never reported a converged state, even when no certificate was touched. These commands only read files and write to stdout, so mark them as unchanged. The subsequent copy task remains responsible for reporting an actual change. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	a6e647b842	refactor: drop ineffective remote_src from copy tasks ... All tasks writing the concatenated chain, fullchain and all files pass the file body via `content`. The `remote_src` option only governs how `src` is resolved and is ignored in that case, so it merely suggested a behaviour the tasks never had. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	ad7b76852b	feat: assert that the signing certificate authority is available ... Issuing an intermediate certificate authority or a client certificate always signs against the private key of the parent authority, regardless of whether that authority is managed in the same run. With `certificate_authority_root_ca_skip` or `certificate_authority_intermediate_ca_skip` enabled and no previously provisioned key at the configured path, this surfaced as a generic module error deep inside the signing task. Stat the parent private key upfront and assert its presence, so the failure names the missing path and the variables that control it. Skipping the parent remains valid when its key already exists, because the check inspects the file instead of the skip variable. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschek	b112672d5a	fix(tasks): create passphrase protected client certificate	2026-09-07 22:28:52 +02:00
volker.raschek	a0ea59c528	Initial Commit	2025-07-30 22:09:38 +02:00