54 lines
1.6 KiB
YAML
54 lines
1.6 KiB
YAML
- name: Install requirements
|
|
ansible.builtin.apt:
|
|
name:
|
|
- "ssl-cert"
|
|
|
|
- name: Copy CA certificate file on server
|
|
ansible.builtin.copy:
|
|
src: "ca/ca-certificate.crt"
|
|
dest: "/etc/ssl/certs/local-ca.crt"
|
|
mode: "0644"
|
|
|
|
- name: Create private key for new certificate
|
|
community.crypto.openssl_privatekey:
|
|
path: "/etc/ssl/private/local.key"
|
|
mode: "0640"
|
|
group: "ssl-cert"
|
|
|
|
- name: Create CSR for new certificate
|
|
community.crypto.openssl_csr:
|
|
path: "/etc/ssl/certs/local.csr"
|
|
privatekey_path: "/etc/ssl/private/local.key"
|
|
common_name: "{{ cert_domains[0] }}"
|
|
subject_alt_name: "{{ cert_domains }}"
|
|
country_name: "{{ cert_country_name }}"
|
|
locality_name: "{{ cert_locality_name }}"
|
|
organization_name: "{{ cert_organization_name }}"
|
|
email_address: "{{ cert_email_address }}"
|
|
return_content: true
|
|
register: cert_csr
|
|
|
|
- name: Sign certificate with our CA
|
|
delegate_to: "localhost"
|
|
# noqa: no-handler
|
|
when: "cert_csr.changed"
|
|
community.crypto.x509_certificate_pipe:
|
|
csr_content: "{{ cert_csr.csr }}"
|
|
provider: "ownca"
|
|
ownca_path: "ca/ca-certificate.crt"
|
|
ownca_privatekey_path: "ca/ca-certificate.key"
|
|
ownca_privatekey_passphrase: "{{ vault.ca.passphrase }}"
|
|
ownca_not_after: "{{ cert_not_after }}"
|
|
ownca_not_before: "{{ cert_not_before }}"
|
|
register: cert_certificate
|
|
|
|
- name: Write certificate file on server
|
|
# noqa: no-handler
|
|
when: "cert_csr.changed"
|
|
ansible.builtin.copy:
|
|
dest: "/etc/ssl/certs/local.crt"
|
|
content: "{{ cert_certificate.certificate }}"
|
|
mode: "0644"
|
|
notify:
|
|
- "Reboot host"
|