From 524527ef9da5d64c0f04f70c1f67215967d242a8 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Wed, 20 Dec 2023 13:41:28 +0100
Subject: x509: make ca-certificates accessable for role users

---
 roles/x509/managed-ca/cert/prepare/tasks/main.yml          | 14 +++++++++++++-
 roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2 |  5 ++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

(limited to 'roles/x509/managed-ca')

diff --git a/roles/x509/managed-ca/cert/prepare/tasks/main.yml b/roles/x509/managed-ca/cert/prepare/tasks/main.yml
index 97292b04..13dd6096 100644
--- a/roles/x509/managed-ca/cert/prepare/tasks/main.yml
+++ b/roles/x509/managed-ca/cert/prepare/tasks/main.yml
@@ -70,7 +70,7 @@
       renew_margin: "{{ managed_ca_cert_config.cert.renew_margin | default(managed_ca_cert_default_renew_margin) }}"
   register: _managed_ca_cert_info_
 
-- name: slurp existing existing managed-ca certificate
+- name: slurp existing managed-ca certificate
   when: _managed_ca_cert_file_.stat.exists
   slurp:
     src: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem"
@@ -102,12 +102,24 @@
   - reload services for x509 certificates
   - restart services for x509 certificates
 
+- name: slurp managed-ca CA certificate
+  delegate_to: "{{ managed_ca_cert_config.ca.host }}"
+  slurp:
+    src: "/etc/ssl/managed-ca/{{ managed_ca_cert_config.ca.name }}/crt.pem"
+  register: _managed_ca_ca_cert_
+
+- name: install CA certificate
+  copy:
+    content: "{{ _managed_ca_ca_cert_.content | b64decode }}"
+    dest: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-ca-crt.pem"
+
 - name: export paths to certificate files
   set_fact:
     x509_certificate_path_key: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-key.pem"
     x509_certificate_path_cert: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem"
     x509_certificate_path_chain: ""
     x509_certificate_path_fullchain: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem"
+    x509_certificate_path_ca_cert: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-ca-crt.pem"
 
 - name: generate custom post-renewal script
   when: x509_certificate_renewal is defined
diff --git a/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2 b/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2
index f0757832..0842c527 100644
--- a/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2
+++ b/roles/x509/managed-ca/cert/prepare/templates/updated.sh.j2
@@ -4,7 +4,10 @@
 
 install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'group' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new"
 {%     for src in file.src %}
-cat "{{ lookup('vars', 'x509_certificate_path_' + src) }}" >> "{{ file.dest }}.new"
+{%       set src_file = lookup('vars', 'x509_certificate_path_' + src) %}
+{%       if src_file != "" %}
+cat "{{ src_file }}" >> "{{ file.dest }}.new"
+{%       endif %}
 {%     endfor %}
 mv "{{ file.dest }}.new" "{{ file.dest }}"
 {%   endfor %}
-- 
cgit v1.2.3