volker.raschekandCopilot
e1d6e80837
The role used .yaml while the molecule scenario used .yml, because molecule hard codes molecule.yml and has no fallback for the other extension. Aligning all files on .yml keeps the extension consistent across the repository and avoids surprises when a tool only supports one of both spellings. Co-authored-by: Copilot <copilot@github.com>
73 lines
3.3 KiB
YAML
73 lines
3.3 KiB
YAML
---
|
|
|
|
- name: Create directory to store tls keys and certificates of the intermediate CA
|
|
ansible.builtin.file:
|
|
path: "{{ certificate_authority_intermediate_ca_path }}"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0755"
|
|
state: "directory"
|
|
|
|
- name: Verify that the signing root Certificate Authority (CA) is available
|
|
when: certificate_authority_intermediate_ca_create is defined and
|
|
certificate_authority_intermediate_ca_create
|
|
block:
|
|
- name: Check private key of the root Certificate Authority (CA)
|
|
ansible.builtin.stat:
|
|
path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
|
|
register: _root_ca_privkey
|
|
- name: Assert that the private key of the root Certificate Authority (CA) exists
|
|
ansible.builtin.assert:
|
|
that: _root_ca_privkey.stat.exists
|
|
fail_msg: >-
|
|
Signing the intermediate certificate authority requires
|
|
{{ certificate_authority_root_ca_path }}/privkey.pem. Either unset
|
|
certificate_authority_root_ca_skip so the root certificate authority is created or
|
|
imported, or point certificate_authority_root_ca_path to an existing one.
|
|
|
|
- name: Create unprotected intermediate Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: intermediate_certificate_authority_unprotected.yml
|
|
when: certificate_authority_intermediate_ca_create is defined and
|
|
certificate_authority_intermediate_ca_create and
|
|
certificate_authority_intermediate_ca_tls_key_passphrase is defined and
|
|
certificate_authority_intermediate_ca_tls_key_passphrase | length <= 0
|
|
|
|
- name: Create passphrase protected intermediate Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: intermediate_certificate_authority_protected.yml
|
|
when: certificate_authority_intermediate_ca_create is defined and
|
|
certificate_authority_intermediate_ca_create and
|
|
certificate_authority_intermediate_ca_tls_key_passphrase is defined and
|
|
certificate_authority_intermediate_ca_tls_key_passphrase | length > 0
|
|
|
|
- name: Import intermediate Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: intermediate_certificate_authority_import.yml
|
|
when: certificate_authority_intermediate_ca_create is defined and
|
|
not certificate_authority_intermediate_ca_create
|
|
|
|
- name: Create certificate chain file
|
|
ansible.builtin.include_tasks: concatenate.yml
|
|
vars:
|
|
_concat_sources:
|
|
- "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
|
|
- "{{ certificate_authority_root_ca_path }}/cert.pem"
|
|
_concat_dest: "{{ certificate_authority_intermediate_ca_path }}/chain.pem"
|
|
_concat_mode: "0644"
|
|
|
|
- name: Create certificate fullchain file
|
|
ansible.builtin.include_tasks: concatenate.yml
|
|
vars:
|
|
_concat_sources:
|
|
- "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
|
|
- "{{ certificate_authority_root_ca_path }}/chain.pem"
|
|
_concat_dest: "{{ certificate_authority_intermediate_ca_path }}/fullchain.pem"
|
|
_concat_mode: "0644"
|
|
|
|
- name: Create file with private key and fullchain file of intermediate Certificate Authority (CA)
|
|
ansible.builtin.include_tasks: concatenate.yml
|
|
vars:
|
|
_concat_sources:
|
|
- "{{ certificate_authority_intermediate_ca_path }}/privkey.pem"
|
|
- "{{ certificate_authority_intermediate_ca_path }}/fullchain.pem"
|
|
_concat_dest: "{{ certificate_authority_intermediate_ca_path }}/all.pem"
|
|
_concat_mode: "0600"
|