ansible: Add configurable path prefix for the internal certificate

This allows a task or role to change the variable and deploy the files
in another location. Eg., for samba they can be deployed into
/etc/samba/tls instead.

Change-Id: I0ee629e7b83f2ef4304948aa2627100ebe1b8cef
Signed-off-by: Kienan Stewart <kstewart@efficios.com>

diff --git a/automation/ansible/roles/common/defaults/main.yml b/automation/ansible/roles/common/defaults/main.yml
index 70a3e63bc27cbe3824af927815f01653eea0668b..ef157af5936f56d80f4c04743158c91bbca10c63 100644 (file)
--- a/automation/ansible/roles/common/defaults/main.yml
+++ b/automation/ansible/roles/common/defaults/main.yml
@@ -1,2 +1,5 @@
 ---
 unattended_upgrades: true
+common_certificate_cert_path_prefix: '/etc/ssl/certs'
+common_certificate_key_path_prefix: '/etc/ssl/private'
+common_certificate_deploy_combined_pem: true

diff --git a/automation/ansible/roles/common/tasks/certs.yml b/automation/ansible/roles/common/tasks/certs.yml
index b306cb54bea14afc18a1a4329ec7b6e132320544..eeb1bfa9657fb1fc44885afb2d00ad5206531bd0 100644 (file)
--- a/automation/ansible/roles/common/tasks/certs.yml
+++ b/automation/ansible/roles/common/tasks/certs.yml
@@ -1,7 +1,7 @@
 ---
 - name: Deploy internal certificate
   ansible.builtin.copy:
-    dest: /etc/ssl/certs/internal.efficios.com.pem
+    dest: "{{common_certificate_cert_path_prefix}}/internal.efficios.com.pem"
     mode: '0644'
     owner: 'root'
     group: 'root'
@@ -9,7 +9,7 @@
   register: cert
 - name: Deploy internal certificate key
   ansible.builtin.copy:
-    dest: /etc/ssl/private/internal.efficios.com.key
+    dest: "{{common_certificate_key_path_prefix}}/internal.efficios.com.key"
     mode: '0640'
     owner: 'root'
     group: 'root'
@@ -17,6 +17,6 @@
   register: key
 - name: Deploy combined cert+key
   # haproxy uses a combined certificate and key file
-  when: cert.changed or key.changed
+  when: (cert.changed or key.changed) and common_certificate_deploy_combined_pem
   ansible.builtin.shell:
-    cmd: 'cat /etc/ssl/certs/internal.efficios.com.pem /etc/ssl/private/internal.efficios.com.key > /etc/ssl/private/internal.efficios.com.pem'
+    cmd: "cat {{common_certificate_cert_path_prefix}}/internal.efficios.com.pem {{common_certificate_key_path_prefix}}/internal.efficios.com.key > {{common_certificate_key_path_prefix}}/internal.efficios.com.pem"