Add an ansible module 'fetch_cmd' to fetch the output of a remote command locally.

And use this to fetch all X.509 leaf certificates.

13 files changed, 39 insertions, 52 deletions

diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index 883b6a8..39dc573 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -80,10 +80,9 @@
 - name: Fetch Dovecot's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/dovecot/ssl/imap.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/dovecot/ssl/imap.fripost.org.pem
+             dest=certs/public/imap.fripost.org.pem
   tags:
     - genkey
 
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 4c0ceef..d9a3d47 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -28,10 +28,9 @@
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
-  fetch: src=/etc/postfix/ssl/smtp.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/postfix/ssl/smtp.fripost.org.pem
+             dest=certs/public/smtp.fripost.org.pem
   tags:
     - genkey
 
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index 6ca11c0..62ffa02 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -82,10 +82,9 @@
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
-  fetch: src=/etc/postfix/ssl/mx.fripost.org.pem
-         dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/postfix/ssl/mx.fripost.org.pem
+             dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
   tags:
     - genkey
 
diff --git a/roles/bacula-dir/tasks/main.yml b/roles/bacula-dir/tasks/main.yml
index 6799900..8d182d2 100644
--- a/roles/bacula-dir/tasks/main.yml
+++ b/roles/bacula-dir/tasks/main.yml
@@ -21,10 +21,9 @@
 - name: Fetch Bacula Dir X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
-         dest=certs/bacula/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
+             dest=certs/bacula/{{ inventory_hostname_short }}-dir.pem
   tags:
     - genkey
 
diff --git a/roles/bacula-sd/tasks/main.yml b/roles/bacula-sd/tasks/main.yml
index 5de0d3d..795804f 100644
--- a/roles/bacula-sd/tasks/main.yml
+++ b/roles/bacula-sd/tasks/main.yml
@@ -21,10 +21,9 @@
 - name: Fetch Bacula SD X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem
-         dest=certs/bacula/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem
+             dest=certs/bacula/{{ inventory_hostname_short }}-sd.pem
   tags:
     - genkey
 
diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml
index 960189b..6ad561e 100644
--- a/roles/common-LDAP/tasks/main.yml
+++ b/roles/common-LDAP/tasks/main.yml
@@ -57,10 +57,9 @@
 - name: Fetch slapd's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/ldap/ssl/{{ item.name }}.pem
-         dest=certs/ldap/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/ldap/ssl/{{ item.name }}.pem
+             dest=certs/ldap/{{ item.name }}.pem
   with_items:
     - { group: 'LDAP-provider', name: ldap.fripost.org }
     - { group: 'MX',            name: mx               }
diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml
index f0919e4..1bd2b77 100644
--- a/roles/common/tasks/bacula.yml
+++ b/roles/common/tasks/bacula.yml
@@ -21,10 +21,9 @@
 - name: Fetch Bacula FD X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
-         dest=certs/bacula/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
+             dest=certs/bacula/{{ inventory_hostname_short }}-fd.pem
   tags:
     - genkey
 
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index cd3020b..1533893 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -69,10 +69,9 @@
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
-         dest=certs/postfix/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
+             dest=certs/postfix/{{ ansible_fqdn }}.pem
   tags:
     - genkey
 
diff --git a/roles/common/tasks/munin-node-ssl.yml b/roles/common/tasks/munin-node-ssl.yml
index 59ed7d7..e0b1d8c 100644
--- a/roles/common/tasks/munin-node-ssl.yml
+++ b/roles/common/tasks/munin-node-ssl.yml
@@ -21,10 +21,9 @@
 - name: Fetch Munin X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
-         dest=certs/munin/{{ inventory_hostname }}.pem
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
+             dest=certs/munin/{{ inventory_hostname }}.pem
   tags:
     - genkey
 
diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index df11872..532ca10 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -105,9 +105,8 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/git.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/git.fripost.org.pem
+             dest=certs/public/git.fripost.org.pem
   tags:
     - genkey
diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml
index 34d42bd..caa1abf 100644
--- a/roles/lists/tasks/nginx.yml
+++ b/roles/lists/tasks/nginx.yml
@@ -28,9 +28,8 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/lists.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/lists.fripost.org.pem
+             dest=certs/public/lists.fripost.org.pem
   tags:
     - genkey
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index e416656..ab417e5 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -136,9 +136,8 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/mail.fripost.org.pem
-         dest=certs/public/
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/mail.fripost.org.pem
+             dest=certs/public/mail.fripost.org.pem
   tags:
     - genkey
diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml
index 9748768..3c7ac6f 100644
--- a/roles/wiki/tasks/main.yml
+++ b/roles/wiki/tasks/main.yml
@@ -98,10 +98,9 @@
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
-  fetch: src=/etc/nginx/ssl/www.fripost.org.pem
-         dest=certs/public/fripost.org.pem
-         fail_on_missing=yes
-         flat=yes
+  fetch_cmd: cmd="openssl x509"
+             stdin=/etc/nginx/ssl/www.fripost.org.pem
+             dest=certs/public/fripost.org.pem
   tags:
     - genkey