The update command ran on every play with changed_when tied to its return code, so the role never
reported a converged state. It is a handler now, notified by the anchor symlink and by the three tasks
which write cert.pem of the root certificate authority. Notifying from the certificate tasks as well keeps
the trust store correct on renewal, where the symlink itself stays untouched.
The anchor path and the update command moved into the per os_family vars, because a handler cannot read
the block vars they lived in before. Debian and RedHat need dedicated files again, they agree on the
package name but differ in anchor path, file extension and update command.
Co-authored-by: Copilot <copilot@github.com>
Building chain.pem, fullchain.pem and all.pem was implemented seven times across three task files with
identical stat, awk and copy tasks. The blocks now include tasks/concatenate.yaml and pass the sources, the
destination and the mode, which removes about a hundred lines.
Two side effects come with it. Every source file is checked instead of only the foreign one, so a missing
file skips the block instead of letting awk fail. And the trailing newline of the result is kept, because
stdout_lines joined by a newline dropped it.
Co-authored-by: Copilot <copilot@github.com>
The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed
unreachable for every non root process although they are declared as 0644. That defeats the main purpose of
the role, which is handing a certificate to a service such as nginx or postgres.
The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned
explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey.
Co-authored-by: Copilot <copilot@github.com>
Installing the python cryptography bindings with ansible.builtin.pip is rejected by PEP 668 on distributions
which mark their python installation as externally managed. Fedora 38+, Ubuntu 23.04+ and RHEL 10 are
affected, so the role aborted on its very first task there.
The package names are resolved from vars/ via first_found, which keeps distribution specifics out of the
task file. vars/main.yaml provides python3-cryptography as a fallback for every family without a dedicated
file, Archlinux overrides it with python-cryptography.
Co-authored-by: Copilot <copilot@github.com>
Several parameter descriptions were carried over from unrelated variables and
described the wrong attribute. Both country name parameters claimed to document
a Common Name, the client organizational unit name repeated the Common Name text
and the two client content parameters described a passphrase and a key
algorithm.
The client content parameters now follow the wording already used for their root
and intermediate counterparts. The README tables were regenerated with
readme-generator, which also normalises the column padding of the previously
hand-edited rows.
Additionally fix the misspelled repository owner in the homepage URL and a typo
in the galaxy description.
Co-authored-by: Copilot <copilot@github.com>
The task named "Upgrade python package manager pip" installed pip with
`state: present`, which never upgrades anything, and it did so through
`ansible.builtin.pip`. That module already requires a working pip on the target,
so the task could only ever run when its own result was already satisfied.
Co-authored-by: Copilot <copilot@github.com>
The `awk 1` commands assembling the chain, fullchain and all files declared
`changed_when: chain_content.rc == 0`, which holds on every successful run. As a
result the role never reported a converged state, even when no certificate was
touched.
These commands only read files and write to stdout, so mark them as unchanged.
The subsequent copy task remains responsible for reporting an actual change.
Co-authored-by: Copilot <copilot@github.com>
All tasks writing the concatenated chain, fullchain and all files pass the file
body via `content`. The `remote_src` option only governs how `src` is resolved
and is ignored in that case, so it merely suggested a behaviour the tasks never
had.
Co-authored-by: Copilot <copilot@github.com>
Issuing an intermediate certificate authority or a client certificate always
signs against the private key of the parent authority, regardless of whether
that authority is managed in the same run. With `certificate_authority_root_ca_skip`
or `certificate_authority_intermediate_ca_skip` enabled and no previously
provisioned key at the configured path, this surfaced as a generic module error
deep inside the signing task.
Stat the parent private key upfront and assert its presence, so the failure
names the missing path and the variables that control it. Skipping the parent
remains valid when its key already exists, because the check inspects the file
instead of the skip variable.
Co-authored-by: Copilot <copilot@github.com>
The trust store import hardcoded the RHEL anchor directory and
`update-ca-trust`, although `meta/main.yaml` also declares ArchLinux and Ubuntu
as supported platforms. On those distributions the task created a dangling
symlink outside any trust source and then failed on the missing binary.
Resolve both the anchor path and the update command from a map keyed by
`ansible_facts['os_family']`. Debian based systems additionally require the file
extension `crt`, because `update-ca-certificates` ignores anchors named
otherwise.
Note that the role now depends on gathered facts.
Co-authored-by: Copilot <copilot@github.com>
The previous wording exceeded the description column width generated by
readme-generator, so markdownlint reported MD060/table-column-style for all
three parameter tables. Shorten the hint to an `Example:` clause that fits the
existing column width and pad the cells accordingly, keeping the README stable
across regeneration.
Co-authored-by: Copilot <copilot@github.com>
The variables `certificate_authority_root_ca_subject_alternative_names` and
`certificate_authority_intermediate_ca_subject_alternative_names` were
documented but never referenced by any task, so both CA certificates were always
issued without SANs. Wire them into the corresponding CSR tasks and fall back to
`omit` when the list is empty.
SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed
with `DNS:` by the role. This allows other types such as `IP:` or `email:`,
which the previous rewrite would have corrupted into values like `DNS:IP:...`.
The client tasks additionally dropped `join(',') | quote`, because `quote`
performs shell escaping and `openssl_csr` expects a list.
Since both client CSR tasks only differed in `subject_alt_name`, they collapse
into a single task per file.
BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now
carry their type prefix, for example `DNS:example.local` instead of
`example.local`.
Co-authored-by: Copilot <copilot@github.com>
This task file is only included when
`certificate_authority_client_tls_key_passphrase` is empty, so the private key
is created without encryption. Passing the empty passphrase to `openssl_csr`
made the module attempt to decrypt an unencrypted key instead of treating it as
absent. The sibling CSR task for certificates with SANs already omitted the
attribute, so this also aligns both code paths.
Co-authored-by: Copilot <copilot@github.com>
The task importing the client certificate passed
`certificate_authority_client_tls_crt_content` to `dest`, so the PEM payload
itself was interpreted as a directory path. The certificate was written to a
bogus location derived from its own content instead of the configured client
directory. Use `certificate_authority_client_path` as destination, consistent
with the private key import above.
Co-authored-by: Copilot <copilot@github.com>
The task importing the client private key referenced
`certificate_authority_client_ca_path`, a variable that is declared neither in
`defaults/main.yaml` nor in `meta/argument_specs.yaml`. Every run with
`certificate_authority_client_create: false` therefore aborted with an undefined
variable error before the key was written. Use the actual role variable
`certificate_authority_client_path` instead.
Co-authored-by: Copilot <copilot@github.com>
volker.raschekandCopilot
CSRBot