First commit

ansible/roles/cert/defaults/main.yml

@@ -0,0 +1,10 @@
+# Defaults
+cert_not_after: "+365d"  # valid for one year
+cert_not_before: "-1d"   # valid since yesterday
+
+# Required
+cert_domains: []
+cert_country_name: None
+cert_locality_name: None
+cert_organization_name: None
+cert_email_address: None

ansible/roles/cert/handlers/main.yml

@@ -0,0 +1,2 @@
+- name: Reboot host
+  ansible.builtin.reboot:

ansible/roles/cert/tasks/main.yml

@@ -0,0 +1,53 @@
+- name: Install requirements
+  ansible.builtin.apt:
+    name:
+      - "ssl-cert"
+
+- name: Copy CA certificate file on server
+  ansible.builtin.copy:
+    src: "ca/ca-certificate.crt"
+    dest: "/etc/ssl/certs/local-ca.crt"
+    mode: "0644"
+
+- name: Create private key for new certificate
+  community.crypto.openssl_privatekey:
+    path: "/etc/ssl/private/local.key"
+    mode: "0640"
+    group: "ssl-cert"
+
+- name: Create CSR for new certificate
+  community.crypto.openssl_csr:
+    path: "/etc/ssl/certs/local.csr"
+    privatekey_path: "/etc/ssl/private/local.key"
+    common_name: "{{ cert_domains[0] }}"
+    subject_alt_name: "{{ cert_domains }}"
+    country_name: "{{ cert_country_name }}"
+    locality_name: "{{ cert_locality_name }}"
+    organization_name: "{{ cert_organization_name }}"
+    email_address: "{{ cert_email_address }}"
+    return_content: true
+  register: cert_csr
+
+- name: Sign certificate with our CA
+  delegate_to: "localhost"
+  # noqa: no-handler
+  when: "cert_csr.changed"
+  community.crypto.x509_certificate_pipe:
+    csr_content: "{{ cert_csr.csr }}"
+    provider: "ownca"
+    ownca_path: "ca/ca-certificate.crt"
+    ownca_privatekey_path: "ca/ca-certificate.key"
+    ownca_privatekey_passphrase: "{{ vault.ca.passphrase }}"
+    ownca_not_after: "{{ cert_not_after }}"
+    ownca_not_before: "{{ cert_not_before }}"
+  register: cert_certificate
+
+- name: Write certificate file on server
+  # noqa: no-handler
+  when: "cert_csr.changed"
+  ansible.builtin.copy:
+    dest: "/etc/ssl/certs/local.crt"
+    content: "{{ cert_certificate.certificate }}"
+    mode: "0644"
+  notify:
+    - "Reboot host"