From 91441c684bff2f8807199e4696d39683af02a953 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Wed, 16 Aug 2023 01:04:37 +0200
Subject: add role: x509/static

---
 roles/x509/static/cert/prepare/tasks/main.yml | 81 +++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 roles/x509/static/cert/prepare/tasks/main.yml

(limited to 'roles/x509/static/cert/prepare/tasks/main.yml')

diff --git a/roles/x509/static/cert/prepare/tasks/main.yml b/roles/x509/static/cert/prepare/tasks/main.yml
new file mode 100644
index 00000000..1327c3b3
--- /dev/null
+++ b/roles/x509/static/cert/prepare/tasks/main.yml
@@ -0,0 +1,81 @@
+---
+- name: compute path to static certificate directory
+  set_fact:
+    static_cert_path: "{{ static_cert_config.path | default([static_cert_base_dir, static_cert_name] | path_join) }}"
+
+- name: create directory for static certificate
+  file:
+    path: "{{ static_cert_path }}"
+    state: directory
+    mode: "{{ static_cert_config.mode | default('0700') }}"
+    owner: "{{ static_cert_config.owner | default(omit) }}"
+    group: "{{ static_cert_config.group | default(omit) }}"
+  notify: "{{ x509_notify_on_change | default(omit) }}"
+
+- name: install key for static certificate
+  copy:
+    content: "{{ static_cert_config.key.content }}"
+    dest: "{{ static_cert_path }}/{{ static_cert_name }}-key.pem"
+    mode: "{{ static_cert_config.key.mode | default('0600') }}"
+    owner: "{{ static_cert_config.key.owner | default(omit) }}"
+    group: "{{ static_cert_config.key.group | default(omit) }}"
+  notify: "{{ x509_notify_on_change | default(omit) }}"
+
+- name: install static certificate
+  copy:
+    content: "{{ static_cert_config.cert.content }}"
+    dest: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem"
+    mode: "{{ static_cert_config.cert.mode | default('0644') }}"
+    owner: "{{ static_cert_config.cert.owner | default(omit) }}"
+    group: "{{ static_cert_config.cert.group | default(omit) }}"
+  notify: "{{ x509_notify_on_change | default(omit) }}"
+
+- name: export paths to basic certificate files
+  set_fact:
+    x509_certificate_path_key: "{{ static_cert_path }}/{{ static_cert_name }}-key.pem"
+    x509_certificate_path_fullchain: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem"
+    x509_certificate_path_cert: "{{ static_cert_path }}/{{ static_cert_name }}-crt.pem"
+
+- name: install chain and fullchain for static certificate
+  when: "'chain' in static_cert_config"
+  block:
+  - name: install chain for static certificate
+    copy:
+      content: "{{ static_cert_config.chain.content }}"
+      dest: "{{ static_cert_path }}/{{ static_cert_name }}-chain.pem"
+      mode: "{{ static_cert_config.chain.mode | default('0644') }}"
+      owner: "{{ static_cert_config.chain.owner | default(omit) }}"
+      group: "{{ static_cert_config.chain.group | default(omit) }}"
+    notify: "{{ x509_notify_on_change | default(omit) }}"
+
+  - name: install fullchain for static certificate
+    copy:
+      content: |
+        {{ static_cert_config.cert.content | trim }}
+        {{ static_cert_config.chain.content }}
+      dest: "{{ static_cert_path }}/{{ static_cert_name }}-fullchain.pem"
+      mode: "{{ static_cert_config.cert.mode | default('0644') }}"
+      owner: "{{ static_cert_config.cert.owner | default(omit) }}"
+      group: "{{ static_cert_config.cert.group | default(omit) }}"
+    notify: "{{ x509_notify_on_change | default(omit) }}"
+
+  - name: export paths to additional certificate files
+    set_fact:
+      x509_certificate_path_chain: "{{ static_cert_path }}/{{ static_cert_name }}-chain.pem"
+      x509_certificate_path_fullchain: "{{ static_cert_path }}/{{ static_cert_name }}-fullchain.pem"
+
+- name: make sure chain and fullchain files are removed
+  when: "'chain' not in static_cert_config"
+  block:
+  - name: remove chain/fullchain files
+    loop:
+    - chain
+    - fullchain
+    file:
+      path: "{{ static_cert_path }}/{{ static_cert_name }}-{{ item }}.pem"
+      state: absent
+    notify: "{{ x509_notify_on_change | default(omit) }}"
+
+  - name: make sure variable that points to the chain certificate file is unset
+    set_fact:
+      x509_certificate_path_chain: ""
-- 
cgit v1.2.3