WIP

ansible/roles/certs/defaults/main.yml

@@ -0,0 +1,19 @@
+# Defaults
+certs_default_country_name: null
+certs_default_locality_name: null
+certs_default_organization_name: null
+certs_default_email_address: null
+certs_default_not_after: "+365d"  # valid for one year
+certs_default_not_before: "-1d"   # valid since yesterday
+
+# Required
+certs_ca_passphrase: null
+certs_list: {}
+# - cn: <string>
+#   domains: <array of strings>
+#   country_name: <string>
+#   locality_name: <string>
+#   organization_name: <string>
+#   email_address: <string>
+#   not_after: <string>
+#   not_before: <string>

ansible/roles/certs/handlers/main.yml

@@ -0,0 +1,2 @@
+- name: Reboot host
+  ansible.builtin.reboot:

ansible/roles/certs/tasks/create_cert.yml

@@ -0,0 +1,42 @@
+- name: Create private key for new certificate
+  community.crypto.openssl_privatekey:
+    path: "/etc/ssl/private/{{ cert.cn }}.key"
+    mode: "0640"
+    group: "ssl-cert"
+
+- name: Create CSR for new certificate
+  community.crypto.openssl_csr:
+    path: "/etc/ssl/certs/{{ cert.cn }}.csr"
+    privatekey_path: "/etc/ssl/private/{{ cert.cn }}.key"
+    common_name: "{{ cert.cn }}"
+    subject_alt_name: "{{ cert.domains }}"
+    country_name: "{{ cert.country_name | default(certs_default_country_name) | mandatory }}"
+    locality_name: "{{ cert.locality_name | default(certs_default_locality_name) | mandatory }}"
+    organization_name: "{{ cert.organization_name | default(certs_default_organization_name) | mandatory }}"
+    email_address: "{{ cert.email_address | default(certs_default_email_address) | mandatory }}"
+    return_content: true
+  register: certs_csr
+
+- name: Sign certificate with our CA
+  delegate_to: "localhost"
+  # noqa: no-handler
+  when: "certs_csr.changed"
+  community.crypto.x509_certificate_pipe:
+    csr_content: "{{ certs_csr.csr }}"
+    provider: "ownca"
+    ownca_path: "ca/ca-certificate.crt"
+    ownca_privatekey_path: "ca/ca-certificate.key"
+    ownca_privatekey_passphrase: "{{ certs_ca_passphrase }}"
+    ownca_not_after: "{{ cert.not_after | default(certs_default_not_after) }}"
+    ownca_not_before: "{{ cert.not_before | default(certs_default_not_before) }}"
+  register: certs_certificate
+
+- name: Write certificate file on server
+  # noqa: no-handler
+  when: "certs_csr.changed"
+  ansible.builtin.copy:
+    dest: "/etc/ssl/certs/{{ cert.cn }}.crt"
+    content: "{{ certs_certificate.certificate }}"
+    mode: "0644"
+  notify:
+    - "Reboot host"

ansible/roles/certs/tasks/main.yml

@@ -0,0 +1,16 @@
+- name: Install requirements
+  ansible.builtin.apt:
+    name:
+      - "ssl-cert"
+
+- name: Copy CA certificate file on server
+  ansible.builtin.copy:
+    src: "ca/ca-certificate.crt"
+    dest: "/etc/ssl/certs/local-ca.crt"
+    mode: "0644"
+
+- name: Create certs
+  loop: "{{ certs_list }}"
+  loop_control:
+    loop_var: "cert"
+  ansible.builtin.include_tasks: "create_cert.yml"