---
#--------------------------------------------------------------#
# Issue Certs                                 [infra_cert_issue]
#--------------------------------------------------------------#
- name: generate infra cert
  tags: infra_cert_issue
  become: false
  connection: local
  vars:
    ansible_python_interpreter: "{{ ansible_playbook_python }}"
  block:

    - name: generate private key for infra nodes
      connection: local
      openssl_privatekey:
        path: "files/pki/infra/infra-{{ infra_seq }}.key"
        mode: 0600

    - name: generate signing request for infra nodes
      connection: local
      openssl_csr:
        path: "files/pki/csr/infra-{{ infra_seq }}.csr"
        privatekey_path: "files/pki/infra/infra-{{ infra_seq }}.key"
        common_name: "{{ inventory_hostname }}"
        organization_name: pigsty
        organizational_unit_name: infra
        subject_alt_name:
          - DNS:localhost
          - "DNS:{{ nodename }}"
          - IP:127.0.0.1
          - "IP:{{ inventory_hostname }}"

    - name: signing infra node cert
      connection: local
      openssl_certificate:
        path: "files/pki/infra/infra-{{ infra_seq }}.crt"
        csr_path: "files/pki/csr/infra-{{ infra_seq }}.csr"
        provider: ownca
        ownca_path: files/pki/ca/ca.crt
        ownca_privatekey_path: files/pki/ca/ca.key
        ownca_not_after: "+{{ cert_validity|default('7300d') }}"
        mode: 0644

#--------------------------------------------------------------#
# Deliver Certs                                [infra_cert_copy]
#--------------------------------------------------------------#
- name: copy infra certs
  tags: infra_cert_copy
  copy: src={{ item.src }} dest={{ item.dest }} owner=root group=infra mode={{ item.mode }}
  with_items:
    - { src: "files/pki/infra/infra-{{ infra_seq }}.crt", dest: /etc/pki/infra.crt, mode: '0644' }
    - { src: "files/pki/infra/infra-{{ infra_seq }}.key", dest: /etc/pki/infra.key, mode: '0640' }

...