certs/public: fetch each cert's pubkey (SPKI), not the cert itself.

To avoid new commits upon cert renewal.

7 files changed, 7 insertions, 7 deletions

diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index a596c42..d7bbfb9 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -80,7 +80,7 @@
 - name: Fetch Dovecot's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch_cmd: cmd="openssl x509"
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/dovecot/ssl/imap.fripost.org.pem
              dest=certs/public/imap.fripost.org.pem
   tags:
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index d9a3d47..7ae2680 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -28,7 +28,7 @@
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
-  fetch_cmd: cmd="openssl x509"
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/postfix/ssl/smtp.fripost.org.pem
              dest=certs/public/smtp.fripost.org.pem
   tags:
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index 62ffa02..f95945c 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -82,7 +82,7 @@
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
-  fetch_cmd: cmd="openssl x509"
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/postfix/ssl/mx.fripost.org.pem
              dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
   tags:
diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index 532ca10..48f4d18 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -105,7 +105,7 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch_cmd: cmd="openssl x509"
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/git.fripost.org.pem
              dest=certs/public/git.fripost.org.pem
   tags:
diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml
index caa1abf..fa52781 100644
--- a/roles/lists/tasks/nginx.yml
+++ b/roles/lists/tasks/nginx.yml
@@ -28,7 +28,7 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch_cmd: cmd="openssl x509"
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/lists.fripost.org.pem
              dest=certs/public/lists.fripost.org.pem
   tags:
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index 998026c..24f8fa7 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -139,7 +139,7 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch_cmd: cmd="openssl x509"
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/mail.fripost.org.pem
              dest=certs/public/mail.fripost.org.pem
   tags:
diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml
index 5713513..c07d4f7 100644
--- a/roles/wiki/tasks/main.yml
+++ b/roles/wiki/tasks/main.yml
@@ -102,7 +102,7 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch_cmd: cmd="openssl x509"
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/www.fripost.org.pem
              dest=certs/public/fripost.org.pem
   tags: