67 lines
1.6 KiB
YAML
Executable File
67 lines
1.6 KiB
YAML
Executable File
|
|
- name: Skip wenn Zertifikat deaktiviert
|
|
meta: end_host
|
|
when: not (cert.enabled | default(false))
|
|
|
|
- name: Prüfe Profil
|
|
fail:
|
|
msg: "Kein Zertifikatsprofil definiert auf {{ inventory_hostname }}"
|
|
when: cert.profile is not defined
|
|
|
|
- name: Lade Profildefinition
|
|
set_fact:
|
|
cert_cfg: "{{ cert_profiles[cert.profile] }}"
|
|
|
|
- name: Zielpfad setzen
|
|
set_fact:
|
|
cert_path: "{{ cert_base_path }}/{{ inventory_hostname }}"
|
|
|
|
- name: Verzeichnisse erstellen
|
|
file:
|
|
path: "{{ cert_path }}/{{ item }}"
|
|
state: directory
|
|
mode: '0755'
|
|
loop:
|
|
- KEY
|
|
- CSR
|
|
- CERT
|
|
|
|
- name: Installiere cryptography Abhängigkeit
|
|
apt:
|
|
name:
|
|
- python3-cryptography
|
|
- python3-pip
|
|
state: present
|
|
update_cache: true
|
|
become: true
|
|
ignore_errors: true
|
|
|
|
- name: Private Key erzeugen
|
|
community.crypto.openssl_privatekey:
|
|
path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
|
|
size: "{{ cert_cfg.key_size }}"
|
|
type: RSA
|
|
|
|
- name: FQDN bestimmen
|
|
set_fact:
|
|
cert_fqdn: >-
|
|
{{
|
|
ansible_facts['fqdn']
|
|
| default(ansible_facts['hostname'])
|
|
| default(inventory_hostname ~ '.local')
|
|
}}
|
|
|
|
- name: SAN bauen (DNS + IP)
|
|
set_fact:
|
|
san_list: >-
|
|
{{
|
|
['DNS:' ~ cert_fqdn]
|
|
+ ([ 'IP:' ~ ansible_host ] if ansible_host is defined else [])
|
|
}}
|
|
|
|
- name: CSR erzeugen (dynamisch)
|
|
community.crypto.openssl_csr:
|
|
path: "{{ cert_path }}/CSR/{{ inventory_hostname }}.csr"
|
|
privatekey_path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
|
|
common_name: "{{ cert_fqdn }}"
|
|
subject_alt_name: "{{ san_list }}" |