ansible-roles/ubuntu-deb-general/tasks/pki-basics.yml

---
- name: Ensure that the PKI directory exists
  file: path={{ pki_dir }} state=directory owner=root group=root mode=0755
  tags: [ 'pki', 'ssl', 'ca', 'letsencrypt' ]

- name: Ensure that the PKI subdirectories exist
  file: path={{ pki_dir }}/{{ item }} state=directory owner=root group=root mode=0755
  with_items: '{{ pki_subdirs }}'
  tags: [ 'pki', 'ssl', 'ca', 'letsencrypt' ]

- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Check if a certificate already exists. If so, skip all the related tasks
  stat: path={{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }}
  register: true_cert
  when: ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
  tags: [ 'pki', 'ssl', 'letsencrypt' ]

- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the physical paths
  file: path={{ item }} mode=0755 state=directory
  with_items:
    - '{{ letsencrypt_acme_user_home | default(omit) }}/live'
    - '{{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert' 
    - '{{ letsencrypt_acme_user_home | default(omit) }}/keys/fakeselfsignedcert' 
  when:
    - ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
    - letsencrypt_acme_user_home | default(omit) is defined
  tags: [ 'pki', 'ssl', 'letsencrypt' ]

- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the certificate and private key
  command: openssl req -x509 -newkey rsa:2048 -keyout {{ letsencrypt_acme_user_home | default(omit) }}/keys/fakeselfsignedcert/privkey -out {{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/cert -days 10 -nodes -subj '/CN=self signed certificate'
  args:
    creates: '{{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/cert'
  when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
  tags: [ 'pki', 'ssl', 'letsencrypt' ]

- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the private key
  file: src=../../keys/fakeselfsignedcert/privkey dest={{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/privkey state=link
  when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
  tags: [ 'pki', 'ssl', 'letsencrypt' ]
  
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the chain file
  file: src=cert dest={{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/chain state=link
  when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
  tags: [ 'pki', 'ssl', 'letsencrypt' ]
  
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the fullchain file
  file: src=cert dest={{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/fullchain state=link
  when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
  tags: [ 'pki', 'ssl', 'letsencrypt' ]
  
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the certificate if there is not one
  file: src=../certs/fakeselfsignedcert dest={{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }} state=link
  when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
  tags: [ 'pki', 'ssl', 'letsencrypt' ]
  
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now handle the haproxy special case
  shell: mkdir {{ pki_dir }}/haproxy ; cat {{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }}/privkey {{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }}/cert > {{ pki_dir }}/haproxy/haproxy.pem
  args:
    creates: '{{ pki_dir }}/haproxy/haproxy.pem'
  when:
    - letsencrypt_acme_install is defined and letsencrypt_acme_install
    - haproxy_enabled is defined and haproxy_enabled
  tags: [ 'pki', 'ssl', 'letsencrypt' ]