volker.raschekandCopilot
95181a18d4
Building chain.pem, fullchain.pem and all.pem was implemented seven times across three task files with identical stat, awk and copy tasks. The blocks now include tasks/concatenate.yaml and pass the sources, the destination and the mode, which removes about a hundred lines. Two side effects come with it. Every source file is checked instead of only the foreign one, so a missing file skips the block instead of letting awk fail. And the trailing newline of the result is kept, because stdout_lines joined by a newline dropped it. Co-authored-by: Copilot <copilot@github.com>
73 lines
3.1 KiB
YAML
73 lines
3.1 KiB
YAML
---
|
|
|
|
- name: Create directory to store tls keys and certificates of the client
|
|
ansible.builtin.file:
|
|
path: "{{ certificate_authority_client_path }}"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0755"
|
|
state: directory
|
|
|
|
- name: Verify that the signing intermediate Certificate Authority (CA) is available
|
|
when: certificate_authority_client_create is defined and
|
|
certificate_authority_client_create
|
|
block:
|
|
- name: Check private key of the intermediate Certificate Authority (CA)
|
|
ansible.builtin.stat:
|
|
path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem"
|
|
register: _intermediate_ca_privkey
|
|
- name: Assert that the private key of the intermediate Certificate Authority (CA) exists
|
|
ansible.builtin.assert:
|
|
that: _intermediate_ca_privkey.stat.exists
|
|
fail_msg: >-
|
|
Signing the client certificate requires
|
|
{{ certificate_authority_intermediate_ca_path }}/privkey.pem. Either unset
|
|
certificate_authority_intermediate_ca_skip so the intermediate certificate authority is
|
|
created or imported, or point certificate_authority_intermediate_ca_path to an existing one.
|
|
|
|
- name: Create unprotected client certificate
|
|
ansible.builtin.include_tasks: client_certificate_unprotected.yaml
|
|
when: certificate_authority_client_create is defined and
|
|
certificate_authority_client_create and
|
|
certificate_authority_client_tls_key_passphrase is defined and
|
|
certificate_authority_client_tls_key_passphrase | length <= 0
|
|
|
|
- name: Create passphrase protected client certificate
|
|
ansible.builtin.include_tasks: client_certificate_protected.yaml
|
|
when: certificate_authority_client_create is defined and
|
|
certificate_authority_client_create and
|
|
certificate_authority_client_tls_key_passphrase is defined and
|
|
certificate_authority_client_tls_key_passphrase | length > 0
|
|
|
|
- name: Import client certificate
|
|
ansible.builtin.include_tasks: client_certificate_import.yaml
|
|
when: certificate_authority_client_create is defined and
|
|
not certificate_authority_client_create
|
|
|
|
- name: Create certificate chain file
|
|
ansible.builtin.include_tasks: concatenate.yaml
|
|
vars:
|
|
_concat_sources:
|
|
- "{{ certificate_authority_client_path }}/cert.pem"
|
|
- "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
|
|
_concat_dest: "{{ certificate_authority_client_path }}/chain.pem"
|
|
_concat_mode: "0644"
|
|
|
|
- name: Create certificate fullchain file
|
|
ansible.builtin.include_tasks: concatenate.yaml
|
|
vars:
|
|
_concat_sources:
|
|
- "{{ certificate_authority_client_path }}/cert.pem"
|
|
- "{{ certificate_authority_intermediate_ca_path }}/chain.pem"
|
|
_concat_dest: "{{ certificate_authority_client_path }}/fullchain.pem"
|
|
_concat_mode: "0644"
|
|
|
|
- name: Create file with private key and fullchain file of the client
|
|
ansible.builtin.include_tasks: concatenate.yaml
|
|
vars:
|
|
_concat_sources:
|
|
- "{{ certificate_authority_client_path }}/privkey.pem"
|
|
- "{{ certificate_authority_client_path }}/fullchain.pem"
|
|
_concat_dest: "{{ certificate_authority_client_path }}/all.pem"
|
|
_concat_mode: "0600"
|