80 lines
2.8 KiB
YAML
80 lines
2.8 KiB
YAML
---
|
|
# Request the certificate for the host from IPA
|
|
# System must be enrolled as an IPA Client and must be ran as root
|
|
- name: Check if host is IPA enrolled
|
|
shell: /usr/sbin/ipa-client-install --unattended 2>&1 | grep "already configured"
|
|
register: ipacheck
|
|
ignore_errors: true
|
|
|
|
- name: Check certificate existence
|
|
stat:
|
|
path: "{{ item.key_location | default(ipa_getcert_cert_default_location) }}/{{ item.name }}.crt"
|
|
register: cert_results
|
|
with_items: "{{ ipa_getcert_requested_hostnames }}"
|
|
ignore_errors: true
|
|
|
|
- name: Verify certificate existence
|
|
assert:
|
|
that:
|
|
- not item.stat.exists | mandatory
|
|
fail_msg: "Certificate already exists!"
|
|
success_msg: "Certificate doesn't exist, moving on"
|
|
quiet: true
|
|
with_items: "{{ cert_results.results }}"
|
|
|
|
- name: IPA Certificate Operations
|
|
block:
|
|
- name: Deploy ipa-getcert script
|
|
template:
|
|
src: "get_cert.sh.j2"
|
|
dest: "/root/get_cert.sh"
|
|
owner: root
|
|
group: root
|
|
mode: '0750'
|
|
|
|
- name: Request Certificate
|
|
raw: /root/get_cert.sh
|
|
register: ipa_cert_request
|
|
|
|
- name: Chain link certificates
|
|
block:
|
|
- name: Create chain directory
|
|
file:
|
|
state: directory
|
|
path: "{{ ipa_getcert_chain_location }}"
|
|
owner: root
|
|
group: "{{ ipa_getcert_group }}"
|
|
mode: '0750'
|
|
|
|
- name: Chain link certs
|
|
file:
|
|
state: link
|
|
src: "{{ item.cert_location | default(ipa_getcert_cert_default_location) }}/{{ item.name }}.crt"
|
|
dest: "{{ ipa_getcert_chain_location }}/{{ item.name }}.crt"
|
|
owner: "{{ item.owner | default(ipa_getcert_owner_default) }}"
|
|
group: "{{ item.owner | default(ipa_getcert_owner_default) }}"
|
|
with_items: "{{ ipa_getcert_requested_hostnames }}"
|
|
|
|
- name: Chain link keys
|
|
file:
|
|
state: link
|
|
src: "{{ item.key_location | default(ipa_getcert_cert_default_location) }}/{{ item.name }}.key"
|
|
path: "{{ ipa_getcert_chain_location }}/{{ item.name }}.key"
|
|
owner: "{{ item.owner | default(ipa_getcert_owner_default) }}"
|
|
group: "{{ item.owner | default(ipa_getcert_owner_default) }}"
|
|
with_items: "{{ ipa_getcert_requested_hostnames }}"
|
|
|
|
- name: Assemble the chain
|
|
assemble:
|
|
src: "{{ ipa_getcert_chain_location }}"
|
|
dest: "{{ ipa_getcert_chain_location }}/{{ item.name }}.pem"
|
|
regexp: "^{{ item.name }}.(crt|key)$"
|
|
owner: "{{ item.owner | default(ipa_getcert_owner_default) }}"
|
|
group: "{{ item.owner | default(ipa_getcert_owner_default) }}"
|
|
mode: '0640'
|
|
with_items: "{{ ipa_getcert_requested_hostnames }}"
|
|
when: ipa_getcert_chain
|
|
when:
|
|
- ipacheck.rc == 0
|
|
- ipa_cert_request.rc == 0
|