---
- include_role:
name: sys-ca-selfsigned
when: run_once_sys_ca_selfsigned is not defined
- name: "✅ CA trust | ensure directories exist"
become: true
ansible.builtin.file:
path: "{{ item }}"
state: directory
mode: "0755"
loop:
- "{{ CA_TRUST.cert_host | dirname }}"
- "{{ BIN_CA_TRUST | dirname }}"
- "{{ BIN_CA_INJECT | dirname }}"
- name: "🔎 CA trust | check CA certificate exists on target host (hard fail if missing)"
become: true
ansible.builtin.stat:
path: "{{ CA_TRUST.cert_host }}"
register: _ca_cert_stat
- name: "🛑 CA trust | fail if CA certificate missing"
ansible.builtin.fail:
msg: >-
CA trust certificate missing on target host: {{ CA_TRUST.cert_host }}.
Provision it before running compose CA injection.
when: not _ca_cert_stat.stat.exists
- name: "📦 CA trust | install compose CA inject script"
become: true
ansible.builtin.copy:
src: "python/compose_ca.py"
dest: "{{ BIN_CA_INJECT }}"
mode: "0755"
owner: root
group: root
- include_tasks: utils/once/flag.yml
