8 Commits

Include renames

Author	SHA1	Message	Date
volker.raschekandCopilot	a4be99b28b	fix: update the systems trust store from a handler ... The update command ran on every play with changed_when tied to its return code, so the role never reported a converged state. It is a handler now, notified by the anchor symlink and by the three tasks which write cert.pem of the root certificate authority. Notifying from the certificate tasks as well keeps the trust store correct on renewal, where the symlink itself stays untouched. The anchor path and the update command moved into the per os_family vars, because a handler cannot read the block vars they lived in before. Debian and RedHat need dedicated files again, they agree on the package name but differ in anchor path, file extension and update command. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	95181a18d4	refactor: extract the duplicated certificate concatenation into a shared task file ... Building chain.pem, fullchain.pem and all.pem was implemented seven times across three task files with identical stat, awk and copy tasks. The blocks now include tasks/concatenate.yaml and pass the sources, the destination and the mode, which removes about a hundred lines. Two side effects come with it. Every source file is checked instead of only the foreign one, so a missing file skips the block instead of letting awk fail. And the trailing newline of the result is kept, because stdout_lines joined by a newline dropped it. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	95ea71394e	fix: make issued certificates readable for unprivileged consumers ... The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed unreachable for every non root process although they are declared as 0644. That defeats the main purpose of the role, which is handing a certificate to a service such as nginx or postgres. The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	2cd88df81b	fix: report concatenation commands as unchanged ... The `awk 1` commands assembling the chain, fullchain and all files declared `changed_when: chain_content.rc == 0`, which holds on every successful run. As a result the role never reported a converged state, even when no certificate was touched. These commands only read files and write to stdout, so mark them as unchanged. The subsequent copy task remains responsible for reporting an actual change. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	a6e647b842	refactor: drop ineffective remote_src from copy tasks ... All tasks writing the concatenated chain, fullchain and all files pass the file body via `content`. The `remote_src` option only governs how `src` is resolved and is ignored in that case, so it merely suggested a behaviour the tasks never had. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschekandCopilot	9ea26dc23f	fix: resolve trust store location per distribution family ... The trust store import hardcoded the RHEL anchor directory and `update-ca-trust`, although `meta/main.yaml` also declares ArchLinux and Ubuntu as supported platforms. On those distributions the task created a dangling symlink outside any trust source and then failed on the missing binary. Resolve both the anchor path and the update command from a map keyed by `ansible_facts['os_family']`. Debian based systems additionally require the file extension `crt`, because `update-ca-certificates` ignores anchors named otherwise. Note that the role now depends on gathered facts. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:30:23 +02:00
volker.raschek	dbbaacdc69	fix(root_ca): set passphrase correctly	2025-07-31 09:49:12 +02:00
volker.raschek	a0ea59c528	Initial Commit	2025-07-30 22:09:38 +02:00