Pains-Perdus/ansible_hacky_pki
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

factorize the when condition

Browse source
This commit is contained in:
histausse 2021-09-19 21:40:09 +02:00
parent 3a4d709275
commit ec297a7dd3
Signed by: histausse
GPG key ID: 67486F107F62E9E9
1 changed files with 111 additions and 121 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
roles/generate-cert/tasks/main.yml
View file

@ -22,7 +22,8 @@
register: validity register: validity
when: cert_file.stat.exists when: cert_file.stat.exists
# TODO: Use a block to have only one `when` - name: Generate the certificate
block:
- name: Generate private key - name: Generate private key
become: false become: false
openssl_privatekey: openssl_privatekey:
@ -30,7 +31,6 @@
mode: u=rw,g=,o= mode: u=rw,g=,o=
size: "{{ key_size | default(omit) }}" size: "{{ key_size | default(omit) }}"
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
# TODO: add a revocation methode, most probably crl, with crl_distribution_points # TODO: add a revocation methode, most probably crl, with crl_distribution_points
- name: Generate a Certificate Signing Request - name: Generate a Certificate Signing Request
@ -52,7 +52,6 @@
key_usage_critical: yes key_usage_critical: yes
subject_alt_name: "{{ subject_alt_name | default(omit) }}" subject_alt_name: "{{ subject_alt_name | default(omit) }}"
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Put the CA in a file - name: Put the CA in a file
become: false become: false
@ -60,7 +59,6 @@
content: "{{ ca_cert }}" content: "{{ ca_cert }}"
dest: "/tmp/ansible_hacky_pki_ca.crt" dest: "/tmp/ansible_hacky_pki_ca.crt"
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Put the CA key in a file - name: Put the CA key in a file
become: false become: false
@ -70,7 +68,6 @@
mode: u=rw,g=,o= mode: u=rw,g=,o=
delegate_to: localhost delegate_to: localhost
no_log: yes no_log: yes
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Sign the certificate - name: Sign the certificate
become: false become: false
@ -83,7 +80,6 @@
ownca_privatekey_path: /tmp/ansible_hacky_pki_ca.key ownca_privatekey_path: /tmp/ansible_hacky_pki_ca.key
provider: ownca provider: ownca
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Send private key to the server - name: Send private key to the server
copy: copy:
@ -93,7 +89,6 @@
group: "{{ group | default('root') }}" group: "{{ group | default('root') }}"
mode: "{{ key_mode | default('u=rw,g=,o=') }}" mode: "{{ key_mode | default('u=rw,g=,o=') }}"
no_log: yes no_log: yes
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Send certificate to the server - name: Send certificate to the server
copy: copy:
@ -102,7 +97,6 @@
owner: "{{ owner | default('root') }}" owner: "{{ owner | default('root') }}"
group: "{{ group | default('root') }}" group: "{{ group | default('root') }}"
mode: "{{ key_mode | default('u=rw,g=r,o=r') }}" mode: "{{ key_mode | default('u=rw,g=r,o=r') }}"
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
# Clean up # Clean up
- name: Remove the local cert key - name: Remove the local cert key
@ -111,7 +105,6 @@
path: "/tmp/ansible_hacky_pki_{{ cname }}.key" path: "/tmp/ansible_hacky_pki_{{ cname }}.key"
state: absent state: absent
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Remove the CSR - name: Remove the CSR
become: false become: false
@ -119,7 +112,6 @@
path: "/tmp/ansible_hacky_pki_{{ cname }}.csr" path: "/tmp/ansible_hacky_pki_{{ cname }}.csr"
state: absent state: absent
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Remove the local certificate - name: Remove the local certificate
become: false become: false
@ -127,7 +119,6 @@
path: "/tmp/ansible_hacky_pki_{{ cname }}.crt" path: "/tmp/ansible_hacky_pki_{{ cname }}.crt"
state: absent state: absent
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Remove the CA certificate - name: Remove the CA certificate
become: false become: false
@ -135,7 +126,6 @@
path: /tmp/ansible_hacky_pki_ca.crt path: /tmp/ansible_hacky_pki_ca.crt
state: absent state: absent
delegate_to: localhost delegate_to: localhost
when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
- name: Remove the CA key - name: Remove the CA key
become: false become: false
@ -143,4 +133,4 @@
path: /tmp/ansible_hacky_pki_ca.key path: /tmp/ansible_hacky_pki_ca.key
state: absent state: absent
delegate_to: localhost delegate_to: localhost
when: not key_file.stat.exists when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)