---
- name: "🔎 CA | check if key exists"
ansible.builtin.stat:
path: "{{ CA_ROOT.key_host }}"
register: _ca_key_stat
changed_when: false
- name: "🔎 CA | check if cert exists"
ansible.builtin.stat:
path: "{{ CA_ROOT.cert_host }}"
register: _ca_cert_stat
changed_when: false
- name: "🤔 CA | decide whether regeneration is needed"
ansible.builtin.set_fact:
_ca_regen_needed: >-
{{
(CA_ROOT.force_regen | bool) or
(not (_ca_key_stat.stat.exists | default(false))) or
(not (_ca_cert_stat.stat.exists | default(false)))
}}
changed_when: false
- name: "🗑️ CA | remove outdated key/cert if regeneration requested/needed"
ansible.builtin.file:
path: "{{ item }}"
state: absent
loop:
- "{{ CA_ROOT.key_host }}"
- "{{ CA_ROOT.cert_host }}"
when: _ca_regen_needed | bool
- name: "📄 CA | render openssl config (v3_ca)"
ansible.builtin.template: # nocheck: stack-host-template (delegated to STACK_HOST + run_once by the parent include)
src: "openssl-root-ca.cnf.j2"
dest: "{{ CA_ROOT.openssl_conf_host }}"
owner: root
group: root
mode: "0640"
- name: "⚙️ CA | generate root CA key + cert (self-signed)"
ansible.builtin.command:
argv:
- openssl
- req
- -x509
- -new
- -nodes
- -days
- "{{ CA_ROOT.days | string }}"
- -newkey
- "rsa:{{ CA_ROOT.key_bits }}"
- -keyout
- "{{ CA_ROOT.key_host }}"
- -out
- "{{ CA_ROOT.cert_host }}"
- -config
- "{{ CA_ROOT.openssl_conf_host }}"
- -extensions
- v3_ca
args:
creates: "{{ CA_ROOT.cert_host }}"
when: _ca_regen_needed | bool
- name: "🔐 CA | enforce permissions (private key)"
ansible.builtin.file:
path: "{{ CA_ROOT.key_host }}"
owner: root
group: root
mode: "0600"
