- name: CA and certs | Generate CN certs and keys when: inventory_hostname in groups[postgresql_cacert_ca_host_group] block: - name: Generate an OpenSSL private client key {{ item }} with the default values (4096 bits, RSA) community.crypto.openssl_privatekey: path: "{{ postgresql_ssl_path }}/{{ item }}.key" register: postgresql_cacert_client_key_gen - name: Generate PostgreSQL subject_alt_ips from ansible_host set_fact: postgresql_server_subject_alt_ips_from_ansible_host: "{{ hostvars[item]['ansible_host'] | regex_replace('^', 'IP:') }}" when: hostvars[item]['ansible_host'] is defined - name: Generate PostgreSQL subject_alt_ips from default ipv4 address set_fact: postgresql_server_subject_alt_ips: "{{ hostvars[item]['ansible_default_ipv4']['address'] | regex_replace('^', 'IP:') }}" when: - hostvars[item]['ansible_default_ipv4']['address'] is defined - not postgresql_cacert_multiple_default_gw_workaround - name: Generate PostgreSQL subject_alt_names from inventory_hostname set_fact: postgresql_server_subject_alt_names: "{{ item | regex_replace('^', 'DNS:') }}" - name: Generate PostgreSQL subject_alt_ips from ansible_all_ipv4_addresses set_fact: postgresql_server_subject_alt_ips_all_ipv4: "{{ hostvars[item]['ansible_all_ipv4_addresses'] | map('regex_replace', '^', 'IP:') | join(',') }}" when: hostvars[item]['ansible_all_ipv4_addresses'] is defined - name: Generate PostgreSQL subject_alt_ips from postgresql_cacert_force_append_ips set_fact: postgresql_server_subject_alt_ips_force_append: "{{ postgresql_cacert_force_append_ips | map('regex_replace', '^', 'IP:') | join(',') }}" when: - postgresql_cacert_force_append_ips is defined - postgresql_cacert_force_append_ips | length > 0 - name: Generate PostgreSQL subject_alt_names from postgresql_cacert_force_append_names set_fact: postgresql_server_subject_alt_names_force_append: "{{ postgresql_cacert_force_append_names | map('regex_replace', '^', 'DNS:') | join(',') }}" when: - postgresql_cacert_force_append_names is defined - postgresql_cacert_force_append_names | length > 0 - name: Construct base subject_alt_name set_fact: subject_alt_name: - "{{ postgresql_server_subject_alt_names }}" - "{{ postgresql_server_subject_alt_ips_from_ansible_host }}" - "{{ postgresql_server_subject_alt_ips_all_ipv4 }}" - name: Construct subject_alt_name with postgresql_server_subject_alt_ips set_fact: subject_alt_name: - "{{ subject_alt_name | join(',') }}" - "{{ postgresql_server_subject_alt_ips }}" when: postgresql_server_subject_alt_ips is defined - name: Construct subject_alt_name with postgresql_server_subject_alt_ips_force_append set_fact: subject_alt_name: - "{{ subject_alt_name | join(',') }}" - "{{ postgresql_server_subject_alt_ips_force_append }}" when: postgresql_server_subject_alt_ips_force_append is defined - name: Construct subject_alt_name with postgresql_server_subject_alt_names_force_append set_fact: subject_alt_name: - "{{ subject_alt_name | join(',') }}" - "{{ postgresql_server_subject_alt_names_force_append }}" when: postgresql_server_subject_alt_names_force_append is defined - debug: msg: "{{ subject_alt_name }}" - name: Generate an OpenSSL Certificate Signing Request for client community.crypto.openssl_csr: path: "{{ postgresql_ssl_path }}/{{ item }}.csr" privatekey_path: "{{ postgresql_ssl_path }}/{{ item }}.key" common_name: "{{ item }}" subject_alt_name: "{{ subject_alt_name | join(',') }}" owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" register: postgresql_csr - name: Generate an OpenSSL certificate for client signed with your own CA certificate community.crypto.x509_certificate: path: "{{ postgresql_ssl_path }}/{{ item }}.crt" csr_path: "{{ postgresql_ssl_path }}/{{ item }}.csr" ownca_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt" ownca_privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key" provider: ownca owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" register: postgresql_cert - name: Get {{ item }} OpenSSL crt and key content ansible.builtin.shell: | cat {{ postgresql_ssl_path }}/{{ item }}.crt {{ postgresql_ssl_path }}/{{ item }}.key register: concated_crt_key changed_when: false - name: Concatenate and save {{ item }} OpenSSL crt and key to single file copy: content: "{{ concated_crt_key.stdout }}" dest: "{{ postgresql_ssl_path }}/{{ item }}.pem" - name: Get CN key {{ item }} content slurp: src: "{{ postgresql_ssl_path }}/{{ item }}.key" register: postgresql_cacert_cn_certs_key_b64 - name: Get CN csr {{ item }} content slurp: src: "{{ postgresql_ssl_path }}/{{ item }}.csr" register: postgresql_cacert_cn_certs_csr_b64 - name: Get CN cert {{ item }} content slurp: src: "{{ postgresql_ssl_path }}/{{ item }}.crt" register: postgresql_cacert_cn_certs_cert_b64 - name: Get CN cert and key concat {{ item }} content slurp: src: "{{ postgresql_ssl_path }}/{{ item }}.pem" register: postgresql_cacert_cn_certs_concat_b64 - name: Set facts about {{ item }} key and cert and delegate set_fact: postgresql_cacert_cn_certs_key: "{{ postgresql_cacert_cn_certs_key_b64.content | b64decode }}" postgresql_cacert_cn_certs_csr: "{{ postgresql_cacert_cn_certs_csr_b64.content | b64decode }}" postgresql_cacert_cn_certs_cert: "{{ postgresql_cacert_cn_certs_cert_b64.content | b64decode }}" postgresql_cacert_cn_certs_concat: "{{ postgresql_cacert_cn_certs_concat_b64.content | b64decode }}" delegate_to: "{{ fact_item }}" delegate_facts: true with_items: - "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}" - "{{ groups[postgresql_cacert_clients_group] | default([]) }}" loop_control: loop_var: fact_item - name: Distribute CN certificates become: true when: - inventory_hostname in groups[postgresql_cacert_clients_group] block: - name: CA and cert | Check if dest dir exist on remote host file: name: "{{ postgresql_ssl_path }}" state: directory - name: Put CN key copy: content: "{{ postgresql_cacert_cn_certs_key }}" dest: "{{ postgresql_ssl_path }}/{{ item }}.key" mode: 0600 owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" - name: Put CN csr copy: content: "{{ postgresql_cacert_cn_certs_csr }}" dest: "{{ postgresql_ssl_path }}/{{ item }}.csr" mode: 0644 owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" - name: Put CN cert copy: content: "{{ postgresql_cacert_cn_certs_cert }}" dest: "{{ postgresql_ssl_path }}/{{ item }}.crt" mode: 0644 owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" - name: Put CN key and cert concat copy: content: "{{ postgresql_cacert_cn_certs_concat }}" dest: "{{ postgresql_ssl_path }}/{{ item }}.pem" mode: 0644 owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}"