83 lines
2.6 KiB
YAML
83 lines
2.6 KiB
YAML
---
|
|
- name: prepare list of client certificates
|
|
ansible.builtin.set_fact:
|
|
cert_list: "{{ cert_list | default([]) + [ {'instance': item.0.name, 'pki_dir': item.0.pki_dir, 'client': item.1} ] }}"
|
|
loop: "{{ openvpn_instances | subelements('clients') }}"
|
|
|
|
- name: ensure local PKI directories exist
|
|
ansible.builtin.file:
|
|
path: "{{ item.pki_dir }}"
|
|
state: directory
|
|
mode: '0700'
|
|
loop: "{{ openvpn_instances }}"
|
|
|
|
- name: init pki if missing
|
|
ansible.builtin.command:
|
|
cmd: /opt/easy-rsa/easyrsa --batch init-pki
|
|
creates: "{{ item.pki_dir }}/private"
|
|
environment:
|
|
EASYRSA_PKI: "{{ item.pki_dir }}"
|
|
loop: "{{ openvpn_instances }}"
|
|
|
|
- name: build ca if missing
|
|
ansible.builtin.command:
|
|
cmd: /opt/easy-rsa/easyrsa --batch build-ca nopass
|
|
creates: "{{ item.pki_dir }}/ca.crt"
|
|
environment:
|
|
EASYRSA_PKI: "{{ item.pki_dir }}"
|
|
EASYRSA_REQ_CN: "CA-{{ item.name }}"
|
|
loop: "{{ openvpn_instances }}"
|
|
|
|
- name: build server cert if missing
|
|
ansible.builtin.command:
|
|
cmd: /opt/easy-rsa/easyrsa --batch build-server-full server nopass
|
|
creates: "{{ item.pki_dir }}/issued/server.crt"
|
|
environment:
|
|
EASYRSA_PKI: "{{ item.pki_dir }}"
|
|
loop: "{{ openvpn_instances }}"
|
|
|
|
- name: generate dh params if missing
|
|
ansible.builtin.command:
|
|
cmd: /opt/easy-rsa/easyrsa gen-dh
|
|
creates: "{{ item.pki_dir }}/dh.pem"
|
|
environment:
|
|
EASYRSA_PKI: "{{ item.pki_dir }}"
|
|
loop: "{{ openvpn_instances }}"
|
|
|
|
- name: check client certificates validity
|
|
ansible.builtin.command:
|
|
cmd: "openssl x509 -checkend 2592000 -in {{ item.pki_dir }}/issued/{{ item.client.name }}.crt"
|
|
register: cert_check
|
|
failed_when: false
|
|
changed_when: false
|
|
loop: "{{ cert_list }}"
|
|
|
|
- name: remove old cert file before reissue
|
|
ansible.builtin.file:
|
|
path: "{{ item.item.pki_dir }}/issued/{{ item.item.client.name }}.crt"
|
|
state: absent
|
|
loop: "{{ cert_check.results }}"
|
|
when: item.rc != 0
|
|
|
|
- name: remove old req file before reissue
|
|
ansible.builtin.file:
|
|
path: "{{ item.item.pki_dir }}/reqs/{{ item.item.client.name }}.req"
|
|
state: absent
|
|
loop: "{{ cert_check.results }}"
|
|
when: item.rc != 0
|
|
|
|
- name: remove old key file before reissue
|
|
ansible.builtin.file:
|
|
path: "{{ item.item.pki_dir }}/private/{{ item.item.client.name }}.key"
|
|
state: absent
|
|
loop: "{{ cert_check.results }}"
|
|
when: item.rc != 0
|
|
|
|
- name: issue or renew client certificates
|
|
ansible.builtin.command:
|
|
cmd: /opt/easy-rsa/easyrsa --batch build-client-full "{{ item.item.client.name }}" nopass
|
|
environment:
|
|
EASYRSA_PKI: "{{ item.item.pki_dir }}"
|
|
when: item.rc != 0
|
|
loop: "{{ cert_check.results }}"
|