From 71aefcc229f999f92b25e51b9444b313d95fbc86 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 18 May 2016 00:10:50 +0200 Subject: Add an ansible module 'fetch_cmd' to fetch the output of a remote command locally. And use this to fetch all X.509 leaf certificates. --- roles/IMAP/tasks/imap.yml | 7 +++---- roles/MSA/tasks/main.yml | 7 +++---- roles/MX/tasks/main.yml | 7 +++---- roles/bacula-dir/tasks/main.yml | 7 +++---- roles/bacula-sd/tasks/main.yml | 7 +++---- roles/common-LDAP/tasks/main.yml | 7 +++---- roles/common/tasks/bacula.yml | 7 +++---- roles/common/tasks/mail.yml | 7 +++---- roles/common/tasks/munin-node-ssl.yml | 7 +++---- roles/git/tasks/cgit.yml | 7 +++---- roles/lists/tasks/nginx.yml | 7 +++---- roles/webmail/tasks/roundcube.yml | 7 +++---- roles/wiki/tasks/main.yml | 7 +++---- 13 files changed, 39 insertions(+), 52 deletions(-) (limited to 'roles') diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml index 883b6a8..39dc573 100644 --- a/roles/IMAP/tasks/imap.yml +++ b/roles/IMAP/tasks/imap.yml @@ -80,10 +80,9 @@ - name: Fetch Dovecot's X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/dovecot/ssl/imap.fripost.org.pem - dest=certs/public/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/dovecot/ssl/imap.fripost.org.pem + dest=certs/public/imap.fripost.org.pem tags: - genkey diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml index 4c0ceef..d9a3d47 100644 --- a/roles/MSA/tasks/main.yml +++ b/roles/MSA/tasks/main.yml @@ -28,10 +28,9 @@ # Ensure we don't fetch private data become: False # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file` - fetch: src=/etc/postfix/ssl/smtp.fripost.org.pem - dest=certs/public/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/postfix/ssl/smtp.fripost.org.pem + dest=certs/public/smtp.fripost.org.pem tags: - genkey diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml index 6ca11c0..62ffa02 100644 --- a/roles/MX/tasks/main.yml +++ b/roles/MX/tasks/main.yml @@ -82,10 +82,9 @@ # Ensure we don't fetch private data become: False # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file` - fetch: src=/etc/postfix/ssl/mx.fripost.org.pem - dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/postfix/ssl/mx.fripost.org.pem + dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem tags: - genkey diff --git a/roles/bacula-dir/tasks/main.yml b/roles/bacula-dir/tasks/main.yml index 6799900..8d182d2 100644 --- a/roles/bacula-dir/tasks/main.yml +++ b/roles/bacula-dir/tasks/main.yml @@ -21,10 +21,9 @@ - name: Fetch Bacula Dir X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem - dest=certs/bacula/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem + dest=certs/bacula/{{ inventory_hostname_short }}-dir.pem tags: - genkey diff --git a/roles/bacula-sd/tasks/main.yml b/roles/bacula-sd/tasks/main.yml index 5de0d3d..795804f 100644 --- a/roles/bacula-sd/tasks/main.yml +++ b/roles/bacula-sd/tasks/main.yml @@ -21,10 +21,9 @@ - name: Fetch Bacula SD X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem - dest=certs/bacula/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem + dest=certs/bacula/{{ inventory_hostname_short }}-sd.pem tags: - genkey diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml index 960189b..6ad561e 100644 --- a/roles/common-LDAP/tasks/main.yml +++ b/roles/common-LDAP/tasks/main.yml @@ -57,10 +57,9 @@ - name: Fetch slapd's X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/ldap/ssl/{{ item.name }}.pem - dest=certs/ldap/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/ldap/ssl/{{ item.name }}.pem + dest=certs/ldap/{{ item.name }}.pem with_items: - { group: 'LDAP-provider', name: ldap.fripost.org } - { group: 'MX', name: mx } diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml index f0919e4..1bd2b77 100644 --- a/roles/common/tasks/bacula.yml +++ b/roles/common/tasks/bacula.yml @@ -21,10 +21,9 @@ - name: Fetch Bacula FD X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem - dest=certs/bacula/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem + dest=certs/bacula/{{ inventory_hostname_short }}-fd.pem tags: - genkey diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml index cd3020b..1533893 100644 --- a/roles/common/tasks/mail.yml +++ b/roles/common/tasks/mail.yml @@ -69,10 +69,9 @@ - name: Fetch Postfix's X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/postfix/ssl/{{ ansible_fqdn }}.pem - dest=certs/postfix/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem + dest=certs/postfix/{{ ansible_fqdn }}.pem tags: - genkey diff --git a/roles/common/tasks/munin-node-ssl.yml b/roles/common/tasks/munin-node-ssl.yml index 59ed7d7..e0b1d8c 100644 --- a/roles/common/tasks/munin-node-ssl.yml +++ b/roles/common/tasks/munin-node-ssl.yml @@ -21,10 +21,9 @@ - name: Fetch Munin X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem - dest=certs/munin/{{ inventory_hostname }}.pem - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem + dest=certs/munin/{{ inventory_hostname }}.pem tags: - genkey diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml index df11872..532ca10 100644 --- a/roles/git/tasks/cgit.yml +++ b/roles/git/tasks/cgit.yml @@ -105,9 +105,8 @@ - name: Fetch Nginx's X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/nginx/ssl/git.fripost.org.pem - dest=certs/public/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/nginx/ssl/git.fripost.org.pem + dest=certs/public/git.fripost.org.pem tags: - genkey diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml index 34d42bd..caa1abf 100644 --- a/roles/lists/tasks/nginx.yml +++ b/roles/lists/tasks/nginx.yml @@ -28,9 +28,8 @@ - name: Fetch Nginx's X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/nginx/ssl/lists.fripost.org.pem - dest=certs/public/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/nginx/ssl/lists.fripost.org.pem + dest=certs/public/lists.fripost.org.pem tags: - genkey diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml index e416656..ab417e5 100644 --- a/roles/webmail/tasks/roundcube.yml +++ b/roles/webmail/tasks/roundcube.yml @@ -136,9 +136,8 @@ - name: Fetch Nginx's X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/nginx/ssl/mail.fripost.org.pem - dest=certs/public/ - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/nginx/ssl/mail.fripost.org.pem + dest=certs/public/mail.fripost.org.pem tags: - genkey diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml index 9748768..3c7ac6f 100644 --- a/roles/wiki/tasks/main.yml +++ b/roles/wiki/tasks/main.yml @@ -98,10 +98,9 @@ - name: Fetch Nginx's X.509 certificate # Ensure we don't fetch private data become: False - fetch: src=/etc/nginx/ssl/www.fripost.org.pem - dest=certs/public/fripost.org.pem - fail_on_missing=yes - flat=yes + fetch_cmd: cmd="openssl x509" + stdin=/etc/nginx/ssl/www.fripost.org.pem + dest=certs/public/fripost.org.pem tags: - genkey -- cgit v1.2.3