volker.raschekandCopilot
a4be99b28b
The update command ran on every play with changed_when tied to its return code, so the role never reported a converged state. It is a handler now, notified by the anchor symlink and by the three tasks which write cert.pem of the root certificate authority. Notifying from the certificate tasks as well keeps the trust store correct on renewal, where the symlink itself stays untouched. The anchor path and the update command moved into the per os_family vars, because a handler cannot read the block vars they lived in before. Debian and RedHat need dedicated files again, they agree on the package name but differ in anchor path, file extension and update command. Co-authored-by: Copilot <copilot@github.com>
59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
---
|
|
|
|
- name: Create directory to store tls keys and certificates of the root CA
|
|
ansible.builtin.file:
|
|
path: "{{ certificate_authority_root_ca_path }}"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0755"
|
|
state: "directory"
|
|
|
|
- name: Create unprotected root Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: root_certificate_authority_unprotected.yaml
|
|
when: certificate_authority_root_ca_create is defined and
|
|
certificate_authority_root_ca_create and
|
|
certificate_authority_root_ca_tls_key_passphrase is defined and
|
|
certificate_authority_root_ca_tls_key_passphrase | length <= 0
|
|
|
|
- name: Create passphrase protected root Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: root_certificate_authority_protected.yaml
|
|
when: certificate_authority_root_ca_create is defined and
|
|
certificate_authority_root_ca_create and
|
|
certificate_authority_root_ca_tls_key_passphrase is defined and
|
|
certificate_authority_root_ca_tls_key_passphrase | length > 0
|
|
|
|
- name: Import protected root Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: root_certificate_authority_import.yaml
|
|
when: certificate_authority_root_ca_create is defined and
|
|
not certificate_authority_root_ca_create
|
|
|
|
- name: Create symbolic link for signed root certificate
|
|
ansible.builtin.file:
|
|
src: "{{ certificate_authority_root_ca_path }}/cert.pem"
|
|
dest: "{{ certificate_authority_root_ca_path }}/{{ item }}"
|
|
state: link
|
|
with_items:
|
|
- ca.pem
|
|
- chain.pem
|
|
- fullchain.pem
|
|
|
|
- name: Create file with private key and fullchain file of root Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: concatenate.yaml
|
|
vars:
|
|
_concat_sources:
|
|
- "{{ certificate_authority_root_ca_path }}/privkey.pem"
|
|
- "{{ certificate_authority_root_ca_path }}/fullchain.pem"
|
|
_concat_dest: "{{ certificate_authority_root_ca_path }}/all.pem"
|
|
_concat_mode: "0600"
|
|
|
|
- name: Import certificate of root Certificate Authority (CA) into systems trust store
|
|
ansible.builtin.file:
|
|
src: "{{ certificate_authority_root_ca_path }}/cert.pem"
|
|
dest: "{{ certificate_authority_trust_store_anchor }}"
|
|
owner: root
|
|
group: root
|
|
state: link
|
|
notify: Update systems SSL/TLS trust store
|
|
when: certificate_authority_root_ca_import is defined and
|
|
certificate_authority_root_ca_import
|