diff options
Diffstat (limited to 'roles')
12 files changed, 49 insertions, 6 deletions
diff --git a/roles/mosquitto/tasks/main.yml b/roles/mosquitto/tasks/main.yml index ed872789..41b7dc7a 100644 --- a/roles/mosquitto/tasks/main.yml +++ b/roles/mosquitto/tasks/main.yml @@ -59,6 +59,12 @@ owner: root group: mosquitto mode: "0640" + - dest: "/etc/mosquitto/ca_certificates/{{ item.key }}-ca-crt.pem" + src: + - ca_cert + owner: root + group: mosquitto + mode: "0644" x509_certificate_reload_services: - mosquitto include_role: diff --git a/roles/x509/acmetool/cert/prepare/tasks/main.yml b/roles/x509/acmetool/cert/prepare/tasks/main.yml index 62f34d01..f750c5fe 100644 --- a/roles/x509/acmetool/cert/prepare/tasks/main.yml +++ b/roles/x509/acmetool/cert/prepare/tasks/main.yml @@ -42,6 +42,7 @@ x509_certificate_path_cert: "/var/lib/acme/live/{{ acmetool_cert_hostnames[0] }}/cert" x509_certificate_path_chain: "/var/lib/acme/live/{{ acmetool_cert_hostnames[0] }}/chain" x509_certificate_path_fullchain: "/var/lib/acme/live/{{ acmetool_cert_hostnames[0] }}/fullchain" + x509_certificate_path_ca_cert: "" - name: setup custom renewal script when: x509_certificate_renewal is defined diff --git a/roles/x509/acmetool/cert/prepare/templates/reload.sh.j2 b/roles/x509/acmetool/cert/prepare/templates/reload.sh.j2 index d707357b..8e1c00c6 100644 --- a/roles/x509/acmetool/cert/prepare/templates/reload.sh.j2 +++ b/roles/x509/acmetool/cert/prepare/templates/reload.sh.j2 @@ -18,7 +18,10 @@ while read name; do {% for file in x509_certificate_renewal.install %} install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'group' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new" {% for src in file.src %} - cat "{{ hostvars[inventory_hostname]['x509_certificate_path_' + src] }}" >> "{{ file.dest }}.new" +{% set src_file = lookup('vars', 'x509_certificate_path_' + src) %} +{% if src_file != "" %} + cat "{{ src_file }}" >> "{{ file.dest }}.new" +{% endif %} {% endfor %} mv "{{ file.dest }}.new" "{{ file.dest }}" {% endfor %} diff --git a/roles/x509/managed-ca/cert/prepare/tasks/main.yml b/roles/x509/managed-ca/cert/prepare/tasks/main.yml index 97292b04..13dd6096 100644 --- a/roles/x509/managed-ca/cert/prepare/tasks/main.yml +++ b/roles/x509/managed-ca/cert/prepare/tasks/main.yml @@ -70,7 +70,7 @@ renew_margin: "{{ managed_ca_cert_config.cert.renew_margin | default(managed_ca_cert_default_renew_margin) }}" register: _managed_ca_cert_info_ -- name: slurp existing existing managed-ca certificate +- name: slurp existing managed-ca certificate when: _managed_ca_cert_file_.stat.exists slurp: src: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem" @@ -102,12 +102,24 @@ - reload services for x509 certificates - restart services for x509 certificates +- name: slurp managed-ca CA certificate + delegate_to: "{{ managed_ca_cert_config.ca.host }}" + slurp: + src: "/etc/ssl/managed-ca/{{ managed_ca_cert_config.ca.name }}/crt.pem" + register: _managed_ca_ca_cert_ + +- name: install CA certificate + copy: + content: "{{ _managed_ca_ca_cert_.content | b64decode }}" + dest: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-ca-crt.pem" + - name: export paths to certificate files set_fact: x509_certificate_path_key: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-key.pem" x509_certificate_path_cert: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem" x509_certificate_path_chain: "" x509_certificate_path_fullchain: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem" + x509_certificate_path_ca_cert: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-ca-crt.pem" - name: generate custom post-renewal script when: x509_certificate_renewal is defined diff --git a/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2 b/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2 index f0757832..0842c527 100644 --- a/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2 +++ b/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2 @@ -4,7 +4,10 @@ install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'group' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new" {% for src in file.src %} -cat "{{ lookup('vars', 'x509_certificate_path_' + src) }}" >> "{{ file.dest }}.new" +{% set src_file = lookup('vars', 'x509_certificate_path_' + src) %} +{% if src_file != "" %} +cat "{{ src_file }}" >> "{{ file.dest }}.new" +{% endif %} {% endfor %} mv "{{ file.dest }}.new" "{{ file.dest }}" {% endfor %} diff --git a/roles/x509/selfsigned/cert/prepare/tasks/main.yml b/roles/x509/selfsigned/cert/prepare/tasks/main.yml index f71acec1..d56e520d 100644 --- a/roles/x509/selfsigned/cert/prepare/tasks/main.yml +++ b/roles/x509/selfsigned/cert/prepare/tasks/main.yml @@ -89,6 +89,7 @@ x509_certificate_path_cert: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" x509_certificate_path_chain: "" x509_certificate_path_fullchain: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" + x509_certificate_path_ca_cert: "" - name: generate custom post-renewal script when: x509_certificate_renewal is defined diff --git a/roles/x509/selfsigned/cert/prepare/templates/updated.sh.j2 b/roles/x509/selfsigned/cert/prepare/templates/updated.sh.j2 index f0757832..0842c527 100644 --- a/roles/x509/selfsigned/cert/prepare/templates/updated.sh.j2 +++ b/roles/x509/selfsigned/cert/prepare/templates/updated.sh.j2 @@ -4,7 +4,10 @@ install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'group' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new" {% for src in file.src %} -cat "{{ lookup('vars', 'x509_certificate_path_' + src) }}" >> "{{ file.dest }}.new" +{% set src_file = lookup('vars', 'x509_certificate_path_' + src) %} +{% if src_file != "" %} +cat "{{ src_file }}" >> "{{ file.dest }}.new" +{% endif %} {% endfor %} mv "{{ file.dest }}.new" "{{ file.dest }}" {% endfor %} diff --git a/roles/x509/static-ca/cert/prepare/tasks/main.yml b/roles/x509/static-ca/cert/prepare/tasks/main.yml index 538bb58d..9a8d1bde 100644 --- a/roles/x509/static-ca/cert/prepare/tasks/main.yml +++ b/roles/x509/static-ca/cert/prepare/tasks/main.yml @@ -84,12 +84,18 @@ - restart services for x509 certificates register: _static_ca_cert_ +- name: install CA certificate + copy: + content: "{{ static_ca_cert_config.ca.cert_content }}" + dest: "{{ static_ca_cert_path }}/{{ static_ca_cert_name }}-ca-crt.pem" + - name: export paths to certificate files set_fact: x509_certificate_path_key: "{{ static_ca_cert_path }}/{{ static_ca_cert_name }}-key.pem" x509_certificate_path_cert: "{{ static_ca_cert_path }}/{{ static_ca_cert_name }}-crt.pem" x509_certificate_path_chain: "" x509_certificate_path_fullchain: "{{ static_ca_cert_path }}/{{ static_ca_cert_name }}-crt.pem" + x509_certificate_path_ca_cert: "{{ static_ca_cert_path }}/{{ static_ca_cert_name }}-ca-crt.pem" - name: generate custom post-renewal script when: x509_certificate_renewal is defined diff --git a/roles/x509/static-ca/cert/prepare/templates/updated.sh.j2 b/roles/x509/static-ca/cert/prepare/templates/updated.sh.j2 index f0757832..0842c527 100644 --- a/roles/x509/static-ca/cert/prepare/templates/updated.sh.j2 +++ b/roles/x509/static-ca/cert/prepare/templates/updated.sh.j2 @@ -4,7 +4,10 @@ install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'group' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new" {% for src in file.src %} -cat "{{ lookup('vars', 'x509_certificate_path_' + src) }}" >> "{{ file.dest }}.new" +{% set src_file = lookup('vars', 'x509_certificate_path_' + src) %} +{% if src_file != "" %} +cat "{{ src_file }}" >> "{{ file.dest }}.new" +{% endif %} {% endfor %} mv "{{ file.dest }}.new" "{{ file.dest }}" {% endfor %} diff --git a/roles/x509/static/cert/prepare/tasks/main.yml b/roles/x509/static/cert/prepare/tasks/main.yml index e8848743..92479873 100644 --- a/roles/x509/static/cert/prepare/tasks/main.yml +++ b/roles/x509/static/cert/prepare/tasks/main.yml @@ -41,6 +41,7 @@ x509_certificate_path_key: "{{ static_cert_path }}/{{ static_cert_name }}-key.pem" x509_certificate_path_fullchain: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem" x509_certificate_path_cert: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem" + x509_certificate_path_ca_cert: "" - name: install chain and fullchain for static certificate when: "'chain' in static_cert_config" diff --git a/roles/x509/uacme/cert/prepare/tasks/main.yml b/roles/x509/uacme/cert/prepare/tasks/main.yml index 887f7355..d968db84 100644 --- a/roles/x509/uacme/cert/prepare/tasks/main.yml +++ b/roles/x509/uacme/cert/prepare/tasks/main.yml @@ -94,6 +94,7 @@ x509_certificate_path_cert: "/var/lib/uacme.d/{{ uacme_cert_name }}/crt.pem" x509_certificate_path_chain: "/var/lib/uacme.d/{{ uacme_cert_name }}/chain.pem" x509_certificate_path_fullchain: "/var/lib/uacme.d/{{ uacme_cert_name }}/{{ uacme_cert_name }}-cert.pem" + x509_certificate_path_ca_cert: "" - name: install script to be called when new certificate is generated template: diff --git a/roles/x509/uacme/cert/prepare/templates/updated.sh.j2 b/roles/x509/uacme/cert/prepare/templates/updated.sh.j2 index b6bd20de..78850cfb 100644 --- a/roles/x509/uacme/cert/prepare/templates/updated.sh.j2 +++ b/roles/x509/uacme/cert/prepare/templates/updated.sh.j2 @@ -17,7 +17,10 @@ chgrp "{{ uacme_cert_config.cert.group }}" $BASE_D/{{ uacme_cert_name }}-cert.pe install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'group' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new" {% for src in file.src %} -cat "{{ hostvars[inventory_hostname]['x509_certificate_path_' + src] }}" >> "{{ file.dest }}.new" +{% set src_file = lookup('vars', 'x509_certificate_path_' + src) %} +{% if src_file != "" %} +cat "{{ src_file }}" >> "{{ file.dest }}.new" +{% endif %} {% endfor %} mv "{{ file.dest }}.new" "{{ file.dest }}" {% endfor %} |