Initialer Import der Synology Scripts

2026-08-05 08:43:57 +02:00
commit 5e32a7c411
404 changed files with 79932 additions and 0 deletions
@@ -0,0 +1,67 @@
+
+- name: Skip wenn Zertifikat deaktiviert
+  meta: end_host
+  when: not (cert.enabled | default(false))
+
+- name: Prüfe Profil
+  fail:
+    msg: "Kein Zertifikatsprofil definiert auf {{ inventory_hostname }}"
+  when: cert.profile is not defined
+
+- name: Lade Profildefinition
+  set_fact:
+    cert_cfg: "{{ cert_profiles[cert.profile] }}"
+
+- name: Zielpfad setzen
+  set_fact:
+    cert_path: "{{ cert_base_path }}/{{ inventory_hostname }}"
+
+- name: Verzeichnisse erstellen
+  file:
+    path: "{{ cert_path }}/{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - KEY
+    - CSR
+    - CERT
+
+- name: Installiere cryptography Abhängigkeit
+  apt:
+    name:
+      - python3-cryptography
+      - python3-pip
+    state: present
+    update_cache: true
+  become: true
+  ignore_errors: true
+
+- name: Private Key erzeugen
+  community.crypto.openssl_privatekey:
+    path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
+    size: "{{ cert_cfg.key_size }}"
+    type: RSA
+
+- name: FQDN bestimmen
+  set_fact:
+    cert_fqdn: >-
+      {{
+        ansible_facts['fqdn']
+        | default(ansible_facts['hostname'])
+        | default(inventory_hostname ~ '.local')
+      }}
+
+- name: SAN bauen (DNS + IP)
+  set_fact:
+    san_list: >-
+      {{
+        ['DNS:' ~ cert_fqdn]
+        + ([ 'IP:' ~ ansible_host ] if ansible_host is defined else [])
+      }}
+
+- name: CSR erzeugen (dynamisch)
+  community.crypto.openssl_csr:
+    path: "{{ cert_path }}/CSR/{{ inventory_hostname }}.csr"
+    privatekey_path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
+    common_name: "{{ cert_fqdn }}"
+    subject_alt_name: "{{ san_list }}"