add nginx, sshd, ssl roles

2026-09-20 22:14:56 +00:00
parent ba9e1a664f
commit c640406c10
131 changed files with 1535 additions and 780 deletions
@@ -0,0 +1,82 @@
+---
+- name: prepare list of client certificates
+  ansible.builtin.set_fact:
+    cert_list: "{{ cert_list | default([]) + [ {'instance': item.0.name, 'pki_dir': item.0.pki_dir, 'client': item.1} ] }}"
+  loop: "{{ openvpn_instances | subelements('clients') }}"
+
+- name: ensure local PKI directories exist
+  ansible.builtin.file:
+    path: "{{ item.pki_dir }}"
+    state: directory
+    mode: '0700'
+  loop: "{{ openvpn_instances }}"
+
+- name: init pki if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch init-pki
+    creates: "{{ item.pki_dir }}/private"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: build ca if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch build-ca nopass
+    creates: "{{ item.pki_dir }}/ca.crt"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+    EASYRSA_REQ_CN: "CA-{{ item.name }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: build server cert if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch build-server-full server nopass
+    creates: "{{ item.pki_dir }}/issued/server.crt"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: generate dh params if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa gen-dh
+    creates: "{{ item.pki_dir }}/dh.pem"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: check client certificates validity
+  ansible.builtin.command:
+    cmd: "openssl x509 -checkend 2592000 -in {{ item.pki_dir }}/issued/{{ item.client.name }}.crt"
+  register: cert_check
+  failed_when: false
+  changed_when: false
+  loop: "{{ cert_list }}"
+
+- name: remove old cert file before reissue
+  ansible.builtin.file:
+    path: "{{ item.item.pki_dir }}/issued/{{ item.item.client.name }}.crt"
+    state: absent
+  loop: "{{ cert_check.results }}"
+  when: item.rc != 0
+
+- name: remove old req file before reissue
+  ansible.builtin.file:
+    path: "{{ item.item.pki_dir }}/reqs/{{ item.item.client.name }}.req"
+    state: absent
+  loop: "{{ cert_check.results }}"
+  when: item.rc != 0
+
+- name: remove old key file before reissue
+  ansible.builtin.file:
+    path: "{{ item.item.pki_dir }}/private/{{ item.item.client.name }}.key"
+    state: absent
+  loop: "{{ cert_check.results }}"
+  when: item.rc != 0
+
+- name: issue or renew client certificates
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch build-client-full "{{ item.item.client.name }}" nopass
+  environment:
+    EASYRSA_PKI: "{{ item.item.pki_dir }}"
+  when: item.rc != 0
+  loop: "{{ cert_check.results }}"