Add an ansible module 'fetch_cmd' to fetch the output of a remote command locally.

And use this to fetch all X.509 leaf certificates.

3 files changed, 9 insertions, 12 deletions

diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml
index f0919e4..1bd2b77 100644
--- a/roles/common/tasks/bacula.yml
+++ b/roles/common/tasks/bacula.yml
@@ -4,44 +4,43 @@
         owner=root group=root
         mode=0755
 
 - name: Generate a private key and a X.509 certificate for Bacula FD
   command: genkeypair.sh x509
                          --pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
                          --privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.key
                          --ou=BaculaFD --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                          -t rsa -b 4096 -h sha512
   register: r1
   changed_when: r1.rc == 0
   failed_when: r1.rc > 1
   notify:
     - Restart stunnel@bacula-fd
   tags:
     - genkey
 
 - name: Fetch Bacula FD X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
-         dest=certs/bacula/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
+             dest=certs/bacula/{{ inventory_hostname_short }}-fd.pem
   tags:
     - genkey
 
 - name: Copy Bacula Dir X.509 certificates
   assemble: src=certs/bacula regexp="-dir\.pem$" remote_src=no
             dest=/etc/stunnel/certs/bacula-dirs.pem
             owner=root group=root
             mode=0644
   register: r2
   when: "'bacula-dir' not in group_names"
   notify:
     - Restart stunnel@bacula-fd
 
 - name: Copy Bacula SD X.509 certificates
   copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem
         dest=/etc/stunnel/certs/
         owner=root group=root
         mode=0644
   register: r3
   with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) }}"
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index cd3020b..1533893 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -52,44 +52,43 @@
   tags:
     - genkey
 
 - name: Generate a private key and a X.509 certificate for Postfix
   command: genkeypair.sh x509
                          --pubkey=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
                          --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key
                          --ou=Postfix --cn={{ ansible_fqdn }}
                          -t rsa -b 4096 -h sha512
   register: r4
   changed_when: r4.rc == 0
   failed_when: r4.rc > 1
   notify:
     - Restart Postfix
   tags:
     - genkey
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
-         dest=certs/postfix/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
+             dest=certs/postfix/{{ ansible_fqdn }}.pem
   tags:
     - genkey
 
 - name: Add a 'root' alias
   lineinfile: dest=/etc/aliases create=yes
               regexp="^root{{':'}} "
               line="root{{':'}} root@fripost.org"
 
 - name: Compile the static local Postfix database
   postmap: cmd=postalias src=/etc/aliases db=cdb
            owner=root group=root
            mode=0644
 
 # We're using CDB
 - name: Delete /etc/aliases.db
   file: path=/etc/aliases.db state=absent
 
 - name: Copy the Postfix TLS policy map
   template: src=etc/postfix/tls_policy.j2
             dest=/etc/postfix/tls_policy
diff --git a/roles/common/tasks/munin-node-ssl.yml b/roles/common/tasks/munin-node-ssl.yml
index 59ed7d7..e0b1d8c 100644
--- a/roles/common/tasks/munin-node-ssl.yml
+++ b/roles/common/tasks/munin-node-ssl.yml
@@ -4,44 +4,43 @@
         owner=root group=root
         mode=0755
 
 - name: Generate a private key and a X.509 certificate for munin-node
   command: genkeypair.sh x509
                          --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
                          --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
                          --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                          -t rsa -b 4096 -h sha512
   register: r1
   changed_when: r1.rc == 0
   failed_when: r1.rc > 1
   notify:
     - Restart stunnel@munin-node
   tags:
     - genkey
 
 - name: Fetch Munin X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
-         dest=certs/munin/{{ inventory_hostname }}.pem
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
+             dest=certs/munin/{{ inventory_hostname }}.pem
   tags:
     - genkey
 
 - name: Copy munin-master X.509 certificates
   assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no
             dest=/etc/stunnel/certs/munin-master.pem
             owner=root group=root
             mode=0644
   register: r2
   when: "'munin-master' not in group_names"
   notify:
     - Restart stunnel@munin-node
 
 - name: Configure stunnel
   template: src=etc/stunnel/munin-node.conf.j2
             dest=/etc/stunnel/munin-node.conf
             owner=root group=root
             mode=0644
   register: r3
   when: "'munin-master' not in group_names"