Rénich Bon Ćirić
39aeb2d6b6
Se estandarizan los nombres de los directorios de roles, cambiando guiones por guiones bajos. Se añaden nuevos scripts para limpieza y callbacks en Koji Hub. Además, se actualizan las configuraciones de Kojid, Kojira y PostgreSQL, incluyendo la instalación de paquetes, ajustes de mock y la gestión de variables.
74 lines
2.7 KiB
YAML
74 lines
2.7 KiB
YAML
---
|
|
- name: "Generate private key for {{ cert.name }}"
|
|
community.crypto.openssl_privatekey:
|
|
path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
|
|
size: "{{ koji_cert_key_size }}"
|
|
mode: "{{ koji_pki_private_key_mode }}"
|
|
|
|
- name: "Generate CSR for {{ cert.name }}"
|
|
community.crypto.openssl_csr:
|
|
path: "{{ koji_pki_dir }}/{{ cert.name }}.csr"
|
|
privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
|
|
common_name: "{{ cert.cn }}"
|
|
country_name: "{{ koji_cert_country }}"
|
|
state_or_province_name: "{{ koji_cert_state }}"
|
|
locality_name: "{{ koji_cert_locality }}"
|
|
organization_name: "{{ koji_cert_organization }}"
|
|
|
|
- name: Create temporary OpenSSL config for signing
|
|
ansible.builtin.copy:
|
|
dest: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
|
|
mode: "0644"
|
|
content: |
|
|
[v3_ca]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
{% if cert.is_server is defined and cert.is_server %}
|
|
extendedKeyUsage = serverAuth, clientAuth
|
|
{% else %}
|
|
extendedKeyUsage = clientAuth
|
|
{% endif %}
|
|
subjectAltName = @alt_names
|
|
[alt_names]
|
|
DNS.1 = {{ cert.cn }}
|
|
{% for san in cert.sans | default([]) %}
|
|
DNS.{{ loop.index + 1 }} = {{ san }}
|
|
{% endfor %}
|
|
|
|
- name: "Sign certificate with our CA"
|
|
ansible.builtin.shell:
|
|
cmd: >
|
|
openssl x509 -req
|
|
-in {{ koji_pki_dir }}/{{ cert.name }}.csr
|
|
-CA {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt
|
|
-CAkey {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key
|
|
-CAserial {{ koji_pki_dir }}/ca.srl
|
|
-CAcreateserial
|
|
-out {{ koji_pki_dir }}/{{ cert.name }}.crt
|
|
-days {{ koji_cert_expiration_days }}
|
|
-sha256
|
|
-extfile {{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf
|
|
-extensions v3_ca
|
|
creates: "{{ koji_pki_dir }}/{{ cert.name }}.crt"
|
|
|
|
- name: "Remove temporary openssl.cnf for {{ cert.name }}"
|
|
ansible.builtin.file:
|
|
path: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
|
|
state: absent
|
|
|
|
- name: "Generate PKCS12 bundle for user {{ cert.name }}"
|
|
community.crypto.openssl_pkcs12:
|
|
action: export
|
|
path: "{{ koji_pki_dir }}/{{ cert.name }}_browser_cert.p12"
|
|
privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
|
|
certificate_path: "{{ koji_pki_dir }}/{{ cert.name }}.crt"
|
|
ca_certificates:
|
|
- "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
|
|
friendly_name: "{{ cert.name }}"
|
|
mode: "{{ koji_pki_file_mode }}"
|
|
when: cert.is_user
|
|
|
|
- name: "Create PEM file for {{ cert.name }}"
|
|
ansible.builtin.shell:
|
|
cmd: "cat {{ koji_pki_dir }}/{{ cert.name }}.crt {{ koji_pki_dir }}/{{ cert.name }}.key > {{ koji_pki_dir }}/{{ cert.name }}.pem"
|
|
creates: "{{ koji_pki_dir }}/{{ cert.name }}.pem"
|