Add an ansible module 'fetch_cmd' to fetch the output of a remote command locally.

And use this to fetch all X.509 leaf certificates.

13 files changed, 39 insertions, 52 deletions

diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index 883b6a8..39dc573 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -63,44 +63,43 @@
     - flagged
     - recent
     - unseen
 
 - name: Create directory /home/mail/spamspool
   file: path=/home/mail/spamspool
         state=directory
         owner=vmail group=vmail
         mode=0700
 
 - name: Create directory /etc/dovecot/ssl
   file: path=/etc/dovecot/ssl
         state=directory
         owner=root group=root
         mode=0755
 
 
 - name: Fetch Dovecot's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/dovecot/ssl/imap.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/dovecot/ssl/imap.fripost.org.pem
+             dest=certs/public/imap.fripost.org.pem
   tags:
     - genkey
 
 - name: Configure Dovecot
   copy: src=etc/dovecot/{{ item }}
         dest=/etc/dovecot/{{ item }}
         owner=root group=root
         mode=0644
   register: r1
   with_items:
     - conf.d/10-auth.conf
     - conf.d/10-logging.conf
     - conf.d/10-mail.conf
     - conf.d/10-master.conf
     - conf.d/10-ssl.conf
     - conf.d/15-mailboxes.conf
     - conf.d/20-imap.conf
     - conf.d/20-lmtp.conf
     - conf.d/90-plugin.conf
     - conf.d/90-sieve.conf
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 4c0ceef..d9a3d47 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -11,44 +11,43 @@
             mode=0644
   notify:
     - Reload Postfix
 
 - name: Copy the Regex to anonymize senders
   # no need to reload upon change, as cleanup(8) is short-running
   copy: src=etc/postfix/anonymize_sender.pcre
         dest=/etc/postfix-{{ postfix_instance[inst].name }}/anonymize_sender.pcre
         owner=root group=root
         mode=0644
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
-  fetch: src=/etc/postfix/ssl/smtp.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/postfix/ssl/smtp.fripost.org.pem
+             dest=certs/public/smtp.fripost.org.pem
   tags:
     - genkey
 
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
         dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   tags:
     - munin
     - munin-node
   notify:
     - Restart munin-node
 
 - name: Install 'postfix_stats_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_stats_
         dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index 6ca11c0..62ffa02 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -65,44 +65,43 @@
            owner=root group=root
            mode=0644
   notify:
     - Reload Postfix
 
 - name: Copy reserved-alias.pl
   copy: src=usr/local/bin/reserved-alias.pl
         dest=/usr/local/bin/reserved-alias.pl
         owner=root group=root
         mode=0755
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
-  fetch: src=/etc/postfix/ssl/mx.fripost.org.pem
-         dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/postfix/ssl/mx.fripost.org.pem
+             dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
   tags:
     - genkey
 
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
         dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   tags:
     - munin
     - munin-node
   notify:
     - Restart munin-node
 
 - name: Install 'postfix_stats_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_stats_
         dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
diff --git a/roles/bacula-dir/tasks/main.yml b/roles/bacula-dir/tasks/main.yml
index 6799900..8d182d2 100644
--- a/roles/bacula-dir/tasks/main.yml
+++ b/roles/bacula-dir/tasks/main.yml
@@ -4,44 +4,43 @@
         owner=root group=root
         mode=0755
 
 - name: Generate a private key and a X.509 certificate for Bacula Dir
   command: genkeypair.sh x509
                          --pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
                          --privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.key
                          --ou=BaculaDir --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                          -t rsa -b 4096 -h sha512
   register: r1
   changed_when: r1.rc == 0
   failed_when: r1.rc > 1
   notify:
     - Restart stunnel@bacula-dir
   tags:
     - genkey
 
 - name: Fetch Bacula Dir X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
-         dest=certs/bacula/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
+             dest=certs/bacula/{{ inventory_hostname_short }}-dir.pem
   tags:
     - genkey
 
 - name: Copy Bacula SD X.509 certificates
   copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem
         dest=/etc/stunnel/certs/
         owner=root group=root
         mode=0644
   with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) | sort }}"
   register: r2
   notify:
     - Restart stunnel@bacula-dir
 
 - name: Copy Bacula FD X.509 certificates
   copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-fd.pem
         dest=/etc/stunnel/certs/
         owner=root group=root
         mode=0644
   with_items: "{{ groups.all | difference([inventory_hostname]) | sort }}"
   register: r3
diff --git a/roles/bacula-sd/tasks/main.yml b/roles/bacula-sd/tasks/main.yml
index 5de0d3d..795804f 100644
--- a/roles/bacula-sd/tasks/main.yml
+++ b/roles/bacula-sd/tasks/main.yml
@@ -4,44 +4,43 @@
         owner=root group=root
         mode=0755
 
 - name: Generate a private key and a X.509 certificate for Bacula SD
   command: genkeypair.sh x509
                          --pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem
                          --privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.key
                          --ou=BaculaSD --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                          -t rsa -b 4096 -h sha512
   register: r1
   changed_when: r1.rc == 0
   failed_when: r1.rc > 1
   notify:
     - Restart stunnel@bacula-sd
   tags:
     - genkey
 
 - name: Fetch Bacula SD X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem
-         dest=certs/bacula/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem
+             dest=certs/bacula/{{ inventory_hostname_short }}-sd.pem
   tags:
     - genkey
 
 - name: Copy Bacula Dir/FD X.509 certificates
   assemble: src=certs/bacula regexp="-(dir|fd)\.pem$" remote_src=no
             dest=/etc/stunnel/certs/bacula-dir+fds.pem
             owner=root group=root
             mode=0644
   register: r2
   notify:
     - Restart stunnel@bacula-sd
 
 - name: Configure stunnel
   template: src=etc/stunnel/bacula-sd.conf.j2
             dest=/etc/stunnel/bacula-sd.conf
             owner=root group=root
             mode=0644
   register: r3
   notify:
     - Restart stunnel@bacula-sd
diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml
index 960189b..6ad561e 100644
--- a/roles/common-LDAP/tasks/main.yml
+++ b/roles/common-LDAP/tasks/main.yml
@@ -40,44 +40,43 @@
                          --pubkey=/etc/ldap/ssl/{{ item.name }}.pem
                          --privkey=/etc/ldap/ssl/{{ item.name }}.key
                          --ou=LDAP {{ item.ou }} --cn={{ item.name }}
                          --usage=digitalSignature,keyEncipherment,keyCertSign
                          -t rsa -b 4096 -h sha256
                          --owner=root --group=openldap --mode=0640
   register: r2
   changed_when: r2.rc == 0
   failed_when: r2.rc > 1
   with_items:
     - { group: 'LDAP-provider', name: ldap.fripost.org, ou:               }
     - { group: 'MX',            name: mx,               ou: --ou=SyncRepl }
     - { group: 'lists',         name: lists,            ou: --ou=SyncRepl }
   when: "item.group in group_names"
   tags:
     - genkey
 
 - name: Fetch slapd's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/ldap/ssl/{{ item.name }}.pem
-         dest=certs/ldap/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/ldap/ssl/{{ item.name }}.pem
+             dest=certs/ldap/{{ item.name }}.pem
   with_items:
     - { group: 'LDAP-provider', name: ldap.fripost.org }
     - { group: 'MX',            name: mx               }
     - { group: 'lists',         name: lists            }
   when: "item.group in group_names"
   tags:
     - genkey
 
 - name: Copy the SyncProv's server certificate
   copy: src=certs/ldap/ldap.fripost.org.pem
         dest=/etc/ldap/ssl/ldap.fripost.org.pem
         owner=root group=root
         mode=0644
   when: "'LDAP-provider' not in group_names"
   tags:
     - genkey
 
 - name: Copy the SyncRepls's client certificates
   assemble: src=certs/ldap remote_src=no
             dest=/etc/ldap/ssl/clients.pem
diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml
index f0919e4..1bd2b77 100644
--- a/roles/common/tasks/bacula.yml
+++ b/roles/common/tasks/bacula.yml
@@ -4,44 +4,43 @@
         owner=root group=root
         mode=0755
 
 - name: Generate a private key and a X.509 certificate for Bacula FD
   command: genkeypair.sh x509
                          --pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
                          --privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.key
                          --ou=BaculaFD --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                          -t rsa -b 4096 -h sha512
   register: r1
   changed_when: r1.rc == 0
   failed_when: r1.rc > 1
   notify:
     - Restart stunnel@bacula-fd
   tags:
     - genkey
 
 - name: Fetch Bacula FD X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
-         dest=certs/bacula/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
+             dest=certs/bacula/{{ inventory_hostname_short }}-fd.pem
   tags:
     - genkey
 
 - name: Copy Bacula Dir X.509 certificates
   assemble: src=certs/bacula regexp="-dir\.pem$" remote_src=no
             dest=/etc/stunnel/certs/bacula-dirs.pem
             owner=root group=root
             mode=0644
   register: r2
   when: "'bacula-dir' not in group_names"
   notify:
     - Restart stunnel@bacula-fd
 
 - name: Copy Bacula SD X.509 certificates
   copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem
         dest=/etc/stunnel/certs/
         owner=root group=root
         mode=0644
   register: r3
   with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) }}"
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index cd3020b..1533893 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -52,44 +52,43 @@
   tags:
     - genkey
 
 - name: Generate a private key and a X.509 certificate for Postfix
   command: genkeypair.sh x509
                          --pubkey=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
                          --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key
                          --ou=Postfix --cn={{ ansible_fqdn }}
                          -t rsa -b 4096 -h sha512
   register: r4
   changed_when: r4.rc == 0
   failed_when: r4.rc > 1
   notify:
     - Restart Postfix
   tags:
     - genkey
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
-         dest=certs/postfix/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
+             dest=certs/postfix/{{ ansible_fqdn }}.pem
   tags:
     - genkey
 
 - name: Add a 'root' alias
   lineinfile: dest=/etc/aliases create=yes
               regexp="^root{{':'}} "
               line="root{{':'}} root@fripost.org"
 
 - name: Compile the static local Postfix database
   postmap: cmd=postalias src=/etc/aliases db=cdb
            owner=root group=root
            mode=0644
 
 # We're using CDB
 - name: Delete /etc/aliases.db
   file: path=/etc/aliases.db state=absent
 
 - name: Copy the Postfix TLS policy map
   template: src=etc/postfix/tls_policy.j2
             dest=/etc/postfix/tls_policy
diff --git a/roles/common/tasks/munin-node-ssl.yml b/roles/common/tasks/munin-node-ssl.yml
index 59ed7d7..e0b1d8c 100644
--- a/roles/common/tasks/munin-node-ssl.yml
+++ b/roles/common/tasks/munin-node-ssl.yml
@@ -4,44 +4,43 @@
         owner=root group=root
         mode=0755
 
 - name: Generate a private key and a X.509 certificate for munin-node
   command: genkeypair.sh x509
                          --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
                          --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
                          --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                          -t rsa -b 4096 -h sha512
   register: r1
   changed_when: r1.rc == 0
   failed_when: r1.rc > 1
   notify:
     - Restart stunnel@munin-node
   tags:
     - genkey
 
 - name: Fetch Munin X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
-         dest=certs/munin/{{ inventory_hostname }}.pem
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
+             dest=certs/munin/{{ inventory_hostname }}.pem
   tags:
     - genkey
 
 - name: Copy munin-master X.509 certificates
   assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no
             dest=/etc/stunnel/certs/munin-master.pem
             owner=root group=root
             mode=0644
   register: r2
   when: "'munin-master' not in group_names"
   notify:
     - Restart stunnel@munin-node
 
 - name: Configure stunnel
   template: src=etc/stunnel/munin-node.conf.j2
             dest=/etc/stunnel/munin-node.conf
             owner=root group=root
             mode=0644
   register: r3
   when: "'munin-master' not in group_names"
diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index df11872..532ca10 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -88,26 +88,25 @@
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/git
   file: src=../sites-available/git
         dest=/etc/nginx/sites-enabled/git
         owner=root group=root
         state=link force=yes
   register: r2
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/git.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/git.fripost.org.pem
+             dest=certs/public/git.fripost.org.pem
   tags:
     - genkey
diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml
index 34d42bd..caa1abf 100644
--- a/roles/lists/tasks/nginx.yml
+++ b/roles/lists/tasks/nginx.yml
@@ -11,26 +11,25 @@
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/sympa
   file: src=../sites-available/sympa
         dest=/etc/nginx/sites-enabled/sympa
         owner=root group=root
         state=link
   register: r2
   notify:
     - Restart Nginx
 
 - name: Start nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/lists.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/lists.fripost.org.pem
+             dest=certs/public/lists.fripost.org.pem
   tags:
     - genkey
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index e416656..ab417e5 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -119,26 +119,25 @@
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/roundcube
   file: src=../sites-available/roundcube
         dest=/etc/nginx/sites-enabled/roundcube
         owner=root group=root
         state=link force=yes
   register: r2
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/mail.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/mail.fripost.org.pem
+             dest=certs/public/mail.fripost.org.pem
   tags:
     - genkey
diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml
index 9748768..3c7ac6f 100644
--- a/roles/wiki/tasks/main.yml
+++ b/roles/wiki/tasks/main.yml
@@ -81,38 +81,37 @@
   file: src=../sites-available/{{ item }}
         dest=/etc/nginx/sites-enabled/{{ item }}
         owner=root group=root
         state=link force=yes
   register: r2
   with_items:
     - website
     - wiki
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/www.fripost.org.pem
-         dest=certs/public/fripost.org.pem
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/www.fripost.org.pem
+             dest=certs/public/fripost.org.pem
   tags:
     - genkey
 
 - name: Create directory /var/www/fripost.org/autoconfig/mail
   file: path=/var/www/fripost.org/autoconfig/mail
         state=directory
         owner=root group=root
         mode=0755
 
 - name: Copy /var/www/fripost.org/autoconfig/mail/config-v1.1.xml
   copy: src=var/www/fripost.org/autoconfig/mail/config-v1.1.xml
         dest=/var/www/fripost.org/autoconfig/mail/config-v1.1.xml
         owner=root group=root
         mode=0644