mono-infrastructure/ansible/playbooks/adhoc-ipagetcert.yml

36 lines
1.6 KiB
YAML
Raw Normal View History

2021-01-17 20:04:57 +00:00
---
# This playbook is meant to be used with callable variables, like adhoc or AWX.
# What: Requests and signs a certificate from an IPA CA
# What is expected:
# -> getcert_name: Name of the certificate (FQDN)
# -> getcert_owner: what account owns the certificate files
# -> getcert_key: path to the certificate key
# -> getcert_cert: path to the certificate
# -> getcert_postcmd: command to run after a certificate renews
# -> getcert_chain: true/false, should cert and key be chained together
# -> getcert_chain_location: location for the chain
2021-08-25 17:32:23 +00:00
# -> getcert_service: service name (eg HTTP, host), defaults to host
2021-01-17 20:04:57 +00:00
# TODO: Add CNAME/SAN support
- name: Request and sign an IPA Certificate
hosts: "{{ host }}"
become: true
vars:
ipa_getcert_requested_hostnames:
- name: "{{ getcert_name|default(ansible_fqdn) }}"
2021-01-24 19:55:38 +00:00
owner: "{{ getcert_owner|default('root') }}"
key_location: "{{ getcert_key|default('/etc/pki/tls/private/newcert.key') }}"
cert_location: "{{ getcert_cert|default('/etc/pki/tls/certs/newcert.crt') }}"
nss_db_dir: "{{ getcert_nss_db_dir|default('/etc/pki/tls/db') }}"
2021-01-20 05:05:28 +00:00
nss_nickname: "{{ getcert_nss_nickname|default(ansible_fqdn) }}"
2021-01-24 19:55:38 +00:00
postcmd: "{{ getcert_postcmd|default(false) }}"
2021-08-25 17:32:23 +00:00
service: "{{ getcert_service|default('host') }}"
2021-01-24 19:55:38 +00:00
ipa_getcert_chain: "{{ getcert_chain|default(false) }}"
ipa_getcert_chain_location: "{{ getcert_chain_location|default('/etc/pki/tls/chain') }}"
2021-01-20 05:05:28 +00:00
ipa_getcert_nss: "{{ getcert_nss|default(false) }}"
2021-01-17 20:04:57 +00:00
roles:
- role: rockylinux.ipagetcert
state: present
...