consul/tasks/ssl/certs.yaml

- name: CA and certs | Generate CN certs and keys
  when: inventory_hostname in groups[consul_cacert_ca_host_group]
  block:
    - name: Generate an OpenSSL private client key {{ item }} with the default values (4096 bits, RSA)
      community.crypto.openssl_privatekey:
        path: "{{ consul_ssl_path }}/{{ item }}.key"
      register: consul_cacert_client_key_gen

    - name: Generate Consul subject_alt_ips from ansible_host
      set_fact:
        consul_server_subject_alt_ips_from_ansible_host: "{{ hostvars[item]['ansible_host'] | regex_replace('^', 'IP:') }}"
      when: hostvars[item]['ansible_host'] is defined

    - name: Generate Consul subject_alt_ips from default ipv4 address
      set_fact:
        consul_server_subject_alt_ips: "{{ hostvars[item]['ansible_default_ipv4']['address'] | regex_replace('^', 'IP:') }}"
      when:
        - hostvars[item]['ansible_default_ipv4']['address'] is defined
        - not consul_cacert_multiple_default_gw_workaround

    - name: Generate Consul subject_alt_names from inventory_hostname
      set_fact:
        consul_server_subject_alt_names: "{{ item | regex_replace('^', 'DNS:') }}"

    - name: Generate Consul subject_alt_ips from ansible_all_ipv4_addresses
      set_fact:
        consul_server_subject_alt_ips_all_ipv4: "{{ hostvars[item]['ansible_all_ipv4_addresses'] | map('regex_replace', '^', 'IP:') | join(',') }}"
      when: hostvars[item]['ansible_all_ipv4_addresses'] is defined

    - name: Generate Consul subject_alt_ips from consul_cacert_force_append_ips
      set_fact:
        consul_server_subject_alt_ips_force_append: "{{ consul_cacert_force_append_ips | map('regex_replace', '^', 'IP:') | join(',') }}"
      when: 
        - consul_cacert_force_append_ips is defined
        - consul_cacert_force_append_ips | length > 0

    - name: Generate Consul subject_alt_names from consul_cacert_force_append_names
      set_fact:
        consul_server_subject_alt_names_force_append: "{{ consul_cacert_force_append_names | map('regex_replace', '^', 'DNS:') | join(',') }}"
      when: 
        - consul_cacert_force_append_names is defined
        - consul_cacert_force_append_names | length > 0

    - name: Construct base subject_alt_name
      set_fact:
        subject_alt_name:
          - "{{ consul_server_subject_alt_names }}"
          - "{{ consul_server_subject_alt_ips_from_ansible_host }}"
          - "{{ consul_server_subject_alt_ips_all_ipv4 }}"

    - name: Construct subject_alt_name with consul_server_subject_alt_ips
      set_fact:
        subject_alt_name:
          - "{{ subject_alt_name | join(',') }}"
          - "{{ consul_server_subject_alt_ips }}"
      when: consul_server_subject_alt_ips is defined

    - name: Construct subject_alt_name with consul_server_subject_alt_ips_force_append
      set_fact:
        subject_alt_name:
          - "{{ subject_alt_name | join(',') }}"
          - "{{ consul_server_subject_alt_ips_force_append }}"
      when: consul_server_subject_alt_ips_force_append is defined

    - name: Construct subject_alt_name with consul_server_subject_alt_names_force_append
      set_fact:
        subject_alt_name:
          - "{{ subject_alt_name | join(',') }}"
          - "{{ consul_server_subject_alt_names_force_append }}"
      when: consul_server_subject_alt_names_force_append is defined

    - debug:
        msg: "{{ subject_alt_name }}"

    - name: Generate an OpenSSL Certificate Signing Request for client
      community.crypto.openssl_csr:
        path: "{{ consul_ssl_path }}/{{ item }}.csr"
        privatekey_path: "{{ consul_ssl_path }}/{{ item }}.key"
        common_name: "{{ item }}"
        subject_alt_name: "{{ subject_alt_name | join(',') }}"
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"
      register: consul_csr

    - name: Generate an OpenSSL certificate for client signed with your own CA certificate
      community.crypto.x509_certificate:
        path: "{{ consul_ssl_path }}/{{ item }}.crt"
        csr_path: "{{ consul_ssl_path }}/{{ item }}.csr"
        ownca_path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.crt"
        ownca_privatekey_path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.key"
        provider: ownca
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"
      register: consul_cert

    - name: Get {{ item }} OpenSSL crt and key content
      ansible.builtin.shell: |
        cat {{ consul_ssl_path }}/{{ item }}.crt {{ consul_ssl_path }}/{{ item }}.key
      register: concated_crt_key
      changed_when: false

    - name: Concatenate and save {{ item }} OpenSSL crt and key to single file
      copy:
        content: "{{ concated_crt_key.stdout }}"
        dest: "{{ consul_ssl_path }}/{{ item }}.pem"

    - name: Get CN key {{ item }} content
      slurp:
        src: "{{ consul_ssl_path }}/{{ item }}.key"
      register: consul_cacert_cn_certs_key_b64

    - name: Get CN csr {{ item }} content
      slurp:
        src: "{{ consul_ssl_path }}/{{ item }}.csr"
      register: consul_cacert_cn_certs_csr_b64

    - name: Get CN cert {{ item }} content
      slurp:
        src: "{{ consul_ssl_path }}/{{ item }}.crt"
      register: consul_cacert_cn_certs_cert_b64

    - name: Get CN cert and key concat {{ item }} content
      slurp:
        src: "{{ consul_ssl_path }}/{{ item }}.pem"
      register: consul_cacert_cn_certs_concat_b64

    - name: Set facts about {{ item }} key and cert and delegate
      set_fact:
        consul_cacert_cn_certs_key: "{{ consul_cacert_cn_certs_key_b64.content | b64decode }}"
        consul_cacert_cn_certs_csr: "{{ consul_cacert_cn_certs_csr_b64.content | b64decode }}"
        consul_cacert_cn_certs_cert: "{{ consul_cacert_cn_certs_cert_b64.content | b64decode }}"
        consul_cacert_cn_certs_concat: "{{ consul_cacert_cn_certs_concat_b64.content | b64decode }}"
      delegate_to: "{{ fact_item }}"
      delegate_facts: true
      with_items:
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: fact_item

- name: Distribute CN certificates
  become: true
  when:
    - inventory_hostname in groups[consul_cacert_clients_group]
  block:
    - name: CA and cert | Check if dest dir exist on remote host
      file:
        name: "{{ consul_ssl_path }}"
        state: directory

    - name: Put CN key
      copy:
        content: "{{ consul_cacert_cn_certs_key }}"
        dest: "{{ consul_ssl_path }}/{{ item }}.key"
        mode: 0600
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"

    - name: Put CN csr
      copy:
        content: "{{ consul_cacert_cn_certs_csr }}"
        dest: "{{ consul_ssl_path }}/{{ item }}.csr"
        mode: 0644
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"

    - name: Put CN cert
      copy:
        content: "{{ consul_cacert_cn_certs_cert }}"
        dest: "{{ consul_ssl_path }}/{{ item }}.crt"
        mode: 0644
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"

    - name: Put CN key and cert concat
      copy:
        content: "{{ consul_cacert_cn_certs_concat }}"
        dest: "{{ consul_ssl_path }}/{{ item }}.pem"
        mode: 0644
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"