diff options
author | Christian Pointner <equinox@spreadspace.org> | 2023-08-22 19:53:49 +0200 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2023-08-22 19:53:49 +0200 |
commit | fc5d0657bfcba53ace230ff2ada64b7fcf9b97a3 (patch) | |
tree | 350a8d401e0113bff7d78aee4d8547cddf06b8f7 /roles/x509/static/cert | |
parent | fix docker for debian bookworm+ (diff) | |
parent | some more cleanup for acme specific variables (diff) |
Merge branch 'topic/uacme'
Diffstat (limited to 'roles/x509/static/cert')
-rw-r--r-- | roles/x509/static/cert/finalize/tasks/main.yml | 2 | ||||
-rw-r--r-- | roles/x509/static/cert/meta/main.yml | 4 | ||||
-rw-r--r-- | roles/x509/static/cert/prepare/defaults/main.yml | 35 | ||||
-rw-r--r-- | roles/x509/static/cert/prepare/handlers/main.yml | 6 | ||||
-rw-r--r-- | roles/x509/static/cert/prepare/tasks/main.yml | 81 |
5 files changed, 128 insertions, 0 deletions
diff --git a/roles/x509/static/cert/finalize/tasks/main.yml b/roles/x509/static/cert/finalize/tasks/main.yml new file mode 100644 index 00000000..c5b6cafe --- /dev/null +++ b/roles/x509/static/cert/finalize/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# nothing to do here diff --git a/roles/x509/static/cert/meta/main.yml b/roles/x509/static/cert/meta/main.yml new file mode 100644 index 00000000..c619208c --- /dev/null +++ b/roles/x509/static/cert/meta/main.yml @@ -0,0 +1,4 @@ +--- +dependencies: + - role: x509/static/cert/prepare + - role: x509/static/cert/finalize diff --git a/roles/x509/static/cert/prepare/defaults/main.yml b/roles/x509/static/cert/prepare/defaults/main.yml new file mode 100644 index 00000000..d632a5de --- /dev/null +++ b/roles/x509/static/cert/prepare/defaults/main.yml @@ -0,0 +1,35 @@ +--- +static_cert_hostnames: "{{ x509_certificate_hostnames }}" +static_cert_name: "{{ x509_certificate_name | default(static_cert_hostnames[0]) }}" + +static_cert_base_dir: "/etc/ssl" + +# static_cert_config: +# path: "{{ static_cert_base_dir }}/{{ static_cert_name }}" +# mode: "0750" +# owner: root +# group: www-data +# key: +# mode: "0640" +# owner: root +# group: www-data +# content: | +# -----BEGIN RSA PRIVATE KEY----- +# ... +# -----END RSA PRIVATE KEY----- +# cert: +# mode: "0644" +# owner: root +# group: www-data +# content: | +# -----BEGIN CERTIFICATE----- +# ... +# -----END CERTIFICATE----- +# chain: +# mode: "0644" +# owner: root +# group: www-data +# content: | +# -----BEGIN CERTIFICATE----- +# ... +# -----END CERTIFICATE----- diff --git a/roles/x509/static/cert/prepare/handlers/main.yml b/roles/x509/static/cert/prepare/handlers/main.yml new file mode 100644 index 00000000..b169d6ca --- /dev/null +++ b/roles/x509/static/cert/prepare/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: reload services for x509 certificates + loop: "{{ x509_certificate_reload_services | default([]) }}" + service: + name: "{{ item }}" + state: reloaded diff --git a/roles/x509/static/cert/prepare/tasks/main.yml b/roles/x509/static/cert/prepare/tasks/main.yml new file mode 100644 index 00000000..03df7542 --- /dev/null +++ b/roles/x509/static/cert/prepare/tasks/main.yml @@ -0,0 +1,81 @@ +--- +- name: compute path to static certificate directory + set_fact: + static_cert_path: "{{ static_cert_config.path | default([static_cert_base_dir, static_cert_name] | path_join) }}" + +- name: create directory for static certificate + file: + path: "{{ static_cert_path }}" + state: directory + mode: "{{ static_cert_config.mode | default('0700') }}" + owner: "{{ static_cert_config.owner | default(omit) }}" + group: "{{ static_cert_config.group | default(omit) }}" + notify: reload services for x509 certificates + +- name: install key for static certificate + copy: + content: "{{ static_cert_config.key.content }}" + dest: "{{ static_cert_path }}/{{ static_cert_name }}-key.pem" + mode: "{{ static_cert_config.key.mode | default('0600') }}" + owner: "{{ static_cert_config.key.owner | default(omit) }}" + group: "{{ static_cert_config.key.group | default(omit) }}" + notify: reload services for x509 certificates + +- name: install static certificate + copy: + content: "{{ static_cert_config.cert.content }}" + dest: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem" + mode: "{{ static_cert_config.cert.mode | default('0644') }}" + owner: "{{ static_cert_config.cert.owner | default(omit) }}" + group: "{{ static_cert_config.cert.group | default(omit) }}" + notify: reload services for x509 certificates + +- name: export paths to basic certificate files + set_fact: + x509_certificate_path_key: "{{ static_cert_path }}/{{ static_cert_name }}-key.pem" + x509_certificate_path_fullchain: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem" + x509_certificate_path_cert: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem" + +- name: install chain and fullchain for static certificate + when: "'chain' in static_cert_config" + block: + - name: install chain for static certificate + copy: + content: "{{ static_cert_config.chain.content }}" + dest: "{{ static_cert_path }}/{{ static_cert_name }}-chain.pem" + mode: "{{ static_cert_config.chain.mode | default('0644') }}" + owner: "{{ static_cert_config.chain.owner | default(omit) }}" + group: "{{ static_cert_config.chain.group | default(omit) }}" + notify: reload services for x509 certificates + + - name: install fullchain for static certificate + copy: + content: | + {{ static_cert_config.cert.content | trim }} + {{ static_cert_config.chain.content }} + dest: "{{ static_cert_path }}/{{ static_cert_name }}-fullchain.pem" + mode: "{{ static_cert_config.cert.mode | default('0644') }}" + owner: "{{ static_cert_config.cert.owner | default(omit) }}" + group: "{{ static_cert_config.cert.group | default(omit) }}" + notify: reload services for x509 certificates + + - name: export paths to additional certificate files + set_fact: + x509_certificate_path_chain: "{{ static_cert_path }}/{{ static_cert_name }}-chain.pem" + x509_certificate_path_fullchain: "{{ static_cert_path }}/{{ static_cert_name }}-fullchain.pem" + +- name: make sure chain and fullchain files are removed + when: "'chain' not in static_cert_config" + block: + - name: remove chain/fullchain files + loop: + - chain + - fullchain + file: + path: "{{ static_cert_path }}/{{ static_cert_name }}-{{ item }}.pem" + state: absent + notify: reload services for x509 certificates + + - name: make sure variable that points to the chain certificate file is unset + set_fact: + x509_certificate_path_chain: "" |