92b2a9d609
- Move all roles from playbooks/roles/ to roles/ - Update roles_path in ansible.cfg - Add cast user to common role - Create standalone podman role - Add semaphore role with Podman + Quadlet support
79 lines
2.5 KiB
YAML
79 lines
2.5 KiB
YAML
---
|
|
# ansible/roles/haproxy/tasks/certificates.yml
|
|
|
|
- name: Check if default certificate exists
|
|
ansible.builtin.stat:
|
|
path: "{{ haproxy_ssl_default_crt }}"
|
|
register: default_cert
|
|
|
|
- name: Generate self-signed certificate for development
|
|
when: not default_cert.stat.exists
|
|
block:
|
|
- name: Generate private key
|
|
openssl_privatekey:
|
|
path: "{{ haproxy_ssl_cert_dir }}/default.key"
|
|
size: 2048
|
|
mode: '0600'
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
|
|
- name: Generate certificate signing request
|
|
openssl_csr:
|
|
path: "{{ haproxy_ssl_cert_dir }}/default.csr"
|
|
privatekey_path: "{{ haproxy_ssl_cert_dir }}/default.key"
|
|
common_name: "lightning-lane.local.mk-labs.cloud"
|
|
subject_alt_name:
|
|
- "DNS:lightning-lane.local.mk-labs.cloud"
|
|
- "DNS:*.local.mk-labs.cloud"
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
|
|
- name: Generate self-signed certificate
|
|
openssl_certificate:
|
|
path: "{{ haproxy_ssl_cert_dir }}/default.crt"
|
|
privatekey_path: "{{ haproxy_ssl_cert_dir }}/default.key"
|
|
csr_path: "{{ haproxy_ssl_cert_dir }}/default.csr"
|
|
provider: selfsigned
|
|
selfsigned_not_after: "+3650d"
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
|
|
- name: Combine certificate and key for HAProxy
|
|
ansible.builtin.shell: |
|
|
cat {{ haproxy_ssl_cert_dir }}/default.crt \
|
|
{{ haproxy_ssl_cert_dir }}/default.key \
|
|
> {{ haproxy_ssl_default_crt }}
|
|
args:
|
|
creates: "{{ haproxy_ssl_default_crt }}"
|
|
|
|
- name: Set permissions on combined certificate
|
|
ansible.builtin.file:
|
|
path: "{{ haproxy_ssl_default_crt }}"
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
mode: '0600'
|
|
|
|
- name: Create certificate directory structure
|
|
ansible.builtin.file:
|
|
path: "{{ haproxy_ssl_cert_dir }}/{{ item }}"
|
|
state: directory
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
mode: '0755'
|
|
loop:
|
|
- live
|
|
- archive
|
|
|
|
- name: Deploy additional certificates
|
|
when: haproxy_ssl_certificates is defined
|
|
block:
|
|
- name: Copy certificate files
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ haproxy_ssl_cert_dir }}/live/{{ item.name }}.pem"
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
mode: '0600'
|
|
loop: "{{ haproxy_ssl_certificates }}"
|
|
notify: Reload haproxy
|