postgresql/tasks/ssl/certs.yaml

- name: CA and certs | Generate CN certs and keys
  when: inventory_hostname in groups[postgresql_cacert_ca_host_group]
  block:
    - name: Generate an OpenSSL private client key {{ item }} with the default values (4096 bits, RSA)
      community.crypto.openssl_privatekey:
        path: "{{ postgresql_ssl_path }}/{{ item }}.key"
      register: postgresql_cacert_client_key_gen

    - name: Generate PostgreSQL subject_alt_ips from ansible_host
      set_fact:
        postgresql_server_subject_alt_ips_from_ansible_host: "{{ hostvars[item]['ansible_host'] | regex_replace('^', 'IP:') }}"
      when: hostvars[item]['ansible_host'] is defined

    - name: Generate PostgreSQL subject_alt_ips from default ipv4 address
      set_fact:
        postgresql_server_subject_alt_ips: "{{ hostvars[item]['ansible_default_ipv4']['address'] | regex_replace('^', 'IP:') }}"
      when:
        - hostvars[item]['ansible_default_ipv4']['address'] is defined
        - not postgresql_cacert_multiple_default_gw_workaround

    - name: Generate PostgreSQL subject_alt_names from inventory_hostname
      set_fact:
        postgresql_server_subject_alt_names: "{{ item | regex_replace('^', 'DNS:') }}"

    - name: Generate PostgreSQL subject_alt_ips from ansible_all_ipv4_addresses
      set_fact:
        postgresql_server_subject_alt_ips_all_ipv4: "{{ hostvars[item]['ansible_all_ipv4_addresses'] | map('regex_replace', '^', 'IP:') | join(',') }}"
      when: hostvars[item]['ansible_all_ipv4_addresses'] is defined

    - name: Generate PostgreSQL subject_alt_ips from postgresql_cacert_force_append_ips
      set_fact:
        postgresql_server_subject_alt_ips_force_append: "{{ postgresql_cacert_force_append_ips | map('regex_replace', '^', 'IP:') | join(',') }}"
      when: 
        - postgresql_cacert_force_append_ips is defined
        - postgresql_cacert_force_append_ips | length > 0

    - name: Generate PostgreSQL subject_alt_names from postgresql_cacert_force_append_names
      set_fact:
        postgresql_server_subject_alt_names_force_append: "{{ postgresql_cacert_force_append_names | map('regex_replace', '^', 'DNS:') | join(',') }}"
      when: 
        - postgresql_cacert_force_append_names is defined
        - postgresql_cacert_force_append_names | length > 0

    - name: Construct base subject_alt_name
      set_fact:
        subject_alt_name:
          - "{{ postgresql_server_subject_alt_names }}"
          - "{{ postgresql_server_subject_alt_ips_from_ansible_host }}"
          - "{{ postgresql_server_subject_alt_ips_all_ipv4 }}"

    - name: Construct subject_alt_name with postgresql_server_subject_alt_ips
      set_fact:
        subject_alt_name:
          - "{{ subject_alt_name | join(',') }}"
          - "{{ postgresql_server_subject_alt_ips }}"
      when: postgresql_server_subject_alt_ips is defined

    - name: Construct subject_alt_name with postgresql_server_subject_alt_ips_force_append
      set_fact:
        subject_alt_name:
          - "{{ subject_alt_name | join(',') }}"
          - "{{ postgresql_server_subject_alt_ips_force_append }}"
      when: postgresql_server_subject_alt_ips_force_append is defined

    - name: Construct subject_alt_name with postgresql_server_subject_alt_names_force_append
      set_fact:
        subject_alt_name:
          - "{{ subject_alt_name | join(',') }}"
          - "{{ postgresql_server_subject_alt_names_force_append }}"
      when: postgresql_server_subject_alt_names_force_append is defined

    - debug:
        msg: "{{ subject_alt_name }}"

    - name: Generate an OpenSSL Certificate Signing Request for client
      community.crypto.openssl_csr:
        path: "{{ postgresql_ssl_path }}/{{ item }}.csr"
        privatekey_path: "{{ postgresql_ssl_path }}/{{ item }}.key"
        common_name: "{{ item }}"
        subject_alt_name: "{{ subject_alt_name | join(',') }}"
        owner: "{{ postgresql_user }}"
        group: "{{ postgresql_group }}"
      register: postgresql_csr

    - name: Generate an OpenSSL certificate for client signed with your own CA certificate
      community.crypto.x509_certificate:
        path: "{{ postgresql_ssl_path }}/{{ item }}.crt"
        csr_path: "{{ postgresql_ssl_path }}/{{ item }}.csr"
        ownca_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
        ownca_privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
        provider: ownca
        owner: "{{ postgresql_user }}"
        group: "{{ postgresql_group }}"
      register: postgresql_cert

    - name: Get {{ item }} OpenSSL crt and key content
      ansible.builtin.shell: |
        cat {{ postgresql_ssl_path }}/{{ item }}.crt {{ postgresql_ssl_path }}/{{ item }}.key        
      register: concated_crt_key
      changed_when: false

    - name: Concatenate and save {{ item }} OpenSSL crt and key to single file
      copy:
        content: "{{ concated_crt_key.stdout }}"
        dest: "{{ postgresql_ssl_path }}/{{ item }}.pem"

    - name: Get CN key {{ item }} content
      slurp:
        src: "{{ postgresql_ssl_path }}/{{ item }}.key"
      register: postgresql_cacert_cn_certs_key_b64

    - name: Get CN csr {{ item }} content
      slurp:
        src: "{{ postgresql_ssl_path }}/{{ item }}.csr"
      register: postgresql_cacert_cn_certs_csr_b64

    - name: Get CN cert {{ item }} content
      slurp:
        src: "{{ postgresql_ssl_path }}/{{ item }}.crt"
      register: postgresql_cacert_cn_certs_cert_b64

    - name: Get CN cert and key concat {{ item }} content
      slurp:
        src: "{{ postgresql_ssl_path }}/{{ item }}.pem"
      register: postgresql_cacert_cn_certs_concat_b64

    - name: Set facts about {{ item }} key and cert and delegate
      set_fact:
        postgresql_cacert_cn_certs_key: "{{ postgresql_cacert_cn_certs_key_b64.content | b64decode }}"
        postgresql_cacert_cn_certs_csr: "{{ postgresql_cacert_cn_certs_csr_b64.content | b64decode }}"
        postgresql_cacert_cn_certs_cert: "{{ postgresql_cacert_cn_certs_cert_b64.content | b64decode }}"
        postgresql_cacert_cn_certs_concat: "{{ postgresql_cacert_cn_certs_concat_b64.content | b64decode }}"
      delegate_to: "{{ fact_item }}"
      delegate_facts: true
      with_items:
        - "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: fact_item

- name: Distribute CN certificates
  become: true
  when:
    - inventory_hostname in groups[postgresql_cacert_clients_group]
  block:
    - name: CA and cert | Check if dest dir exist on remote host
      file:
        name: "{{ postgresql_ssl_path }}"
        state: directory

    - name: Put CN key
      copy:
        content: "{{ postgresql_cacert_cn_certs_key }}"
        dest: "{{ postgresql_ssl_path }}/{{ item }}.key"
        mode: 0600
        owner: "{{ postgresql_user }}"
        group: "{{ postgresql_group }}"

    - name: Put CN csr
      copy:
        content: "{{ postgresql_cacert_cn_certs_csr }}"
        dest: "{{ postgresql_ssl_path }}/{{ item }}.csr"
        mode: 0644
        owner: "{{ postgresql_user }}"
        group: "{{ postgresql_group }}"

    - name: Put CN cert
      copy:
        content: "{{ postgresql_cacert_cn_certs_cert }}"
        dest: "{{ postgresql_ssl_path }}/{{ item }}.crt"
        mode: 0644
        owner: "{{ postgresql_user }}"
        group: "{{ postgresql_group }}"

    - name: Put CN key and cert concat
      copy:
        content: "{{ postgresql_cacert_cn_certs_concat }}"
        dest: "{{ postgresql_ssl_path }}/{{ item }}.pem"
        mode: 0644
        owner: "{{ postgresql_user }}"
        group: "{{ postgresql_group }}"