---
- name: "🏛 Ensure the PKI secrets engine is mounted at '{{ OPENBAO_PKI_MOUNT }}'"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c 'bao secrets list -format=json | grep -q "\"{{ OPENBAO_PKI_MOUNT }}/\"" ||
{ bao secrets enable -path={{ OPENBAO_PKI_MOUNT | quote }} pki && echo OPENBAO_CHANGED; }'
register: openbao_pki_mount
changed_when: "'OPENBAO_CHANGED' in openbao_pki_mount.stdout"
- name: "🔍 Check whether the internal root CA already exists"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c 'bao read -field=certificate {{ OPENBAO_PKI_MOUNT }}/cert/ca 2>/dev/null | grep -q "BEGIN CERTIFICATE"'
register: openbao_pki_ca
changed_when: false
failed_when: false
- name: "🏛 Generate the internal root CA"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
bao write -field=certificate {{ OPENBAO_PKI_MOUNT }}/root/generate/internal
common_name={{ ('Infinito.Nexus Internal CA (' ~ DOMAIN_PRIMARY ~ ')') | quote }}
issuer_name=infinito-root
ttl=87600h
changed_when: true
when: openbao_pki_ca.rc != 0
- name: "🔗 Configure the CA and CRL distribution URLs"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c 'set -e;
p={{ OPENBAO_PKI_MOUNT }}/config/urls;
before=$(bao read -format=json $p 2>/dev/null | grep -v request_id || true);
bao write $p
issuing_certificates={{ OPENBAO_PKI_ISSUING_URL | quote }}
crl_distribution_points={{ OPENBAO_PKI_CRL_URL | quote }} >/dev/null;
after=$(bao read -format=json $p | grep -v request_id);
[ "$before" = "$after" ] || echo OPENBAO_CHANGED'
register: openbao_pki_urls
changed_when: "'OPENBAO_CHANGED' in openbao_pki_urls.stdout"
- name: "📇 Configure the issuing role '{{ OPENBAO_PKI_ISSUING_ROLE }}'"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c 'set -e;
p={{ OPENBAO_PKI_MOUNT }}/roles/{{ OPENBAO_PKI_ISSUING_ROLE }};
before=$(bao read -format=json $p 2>/dev/null | grep -v request_id || true);
bao write $p
allowed_domains={{ DOMAIN_PRIMARY | quote }}
allow_subdomains=true
allow_bare_domains=true
max_ttl=2160h
ttl=720h >/dev/null;
after=$(bao read -format=json $p | grep -v request_id);
[ "$before" = "$after" ] || echo OPENBAO_CHANGED'
register: openbao_pki_role
changed_when: "'OPENBAO_CHANGED' in openbao_pki_role.stdout"
