mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
4039313266
Add tests/lint/repository/test_task_file_numbering.py: numbered task files use exactly two leading digits, a numbered *_core.yml must be 00_core.yml, per directory the numbers are unique/consecutive and start at 01 (00 with a core file), numbered includes appear in ascending order, and shared helpers live in tasks/utils/ instead of the numbered chain. Apply it across every role: rename NN_core.yml to 00_core.yml with a consecutive down-shift of the siblings, move letter-suffix children into a subdirectory named after their parent task, relocate helpers included from more than one place into tasks/utils/, and update every reference (include_tasks, path_absolute, .ansible-lint-ignore, requirement docs). Legacy narration comments in the touched files are deleted; the upstream xwiki.properties reference block opts out via nocheck. The unused MAILU_IP6_PUBLIC var (only ever named in now-removed comments) is dropped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
71 lines
1.8 KiB
YAML
71 lines
1.8 KiB
YAML
---
|
|
- name: "🔎 CA | check if key exists"
|
|
ansible.builtin.stat:
|
|
path: "{{ CA_ROOT.key_host }}"
|
|
register: _ca_key_stat
|
|
changed_when: false
|
|
|
|
- name: "🔎 CA | check if cert exists"
|
|
ansible.builtin.stat:
|
|
path: "{{ CA_ROOT.cert_host }}"
|
|
register: _ca_cert_stat
|
|
changed_when: false
|
|
|
|
- name: "🤔 CA | decide whether regeneration is needed"
|
|
ansible.builtin.set_fact:
|
|
_ca_regen_needed: >-
|
|
{{
|
|
(CA_ROOT.force_regen | bool) or
|
|
(not (_ca_key_stat.stat.exists | default(false))) or
|
|
(not (_ca_cert_stat.stat.exists | default(false)))
|
|
}}
|
|
changed_when: false
|
|
|
|
- name: "🗑️ CA | remove outdated key/cert if regeneration requested/needed"
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- "{{ CA_ROOT.key_host }}"
|
|
- "{{ CA_ROOT.cert_host }}"
|
|
when: _ca_regen_needed | bool
|
|
|
|
- name: "📄 CA | render openssl config (v3_ca)"
|
|
ansible.builtin.template: # nocheck: stack-host-template (delegated to STACK_HOST + run_once by the parent include)
|
|
src: "openssl-root-ca.cnf.j2"
|
|
dest: "{{ CA_ROOT.openssl_conf_host }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
|
|
- name: "⚙️ CA | generate root CA key + cert (self-signed)"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- openssl
|
|
- req
|
|
- -x509
|
|
- -new
|
|
- -nodes
|
|
- -days
|
|
- "{{ CA_ROOT.days | string }}"
|
|
- -newkey
|
|
- "rsa:{{ CA_ROOT.key_bits }}"
|
|
- -keyout
|
|
- "{{ CA_ROOT.key_host }}"
|
|
- -out
|
|
- "{{ CA_ROOT.cert_host }}"
|
|
- -config
|
|
- "{{ CA_ROOT.openssl_conf_host }}"
|
|
- -extensions
|
|
- v3_ca
|
|
args:
|
|
creates: "{{ CA_ROOT.cert_host }}"
|
|
when: _ca_regen_needed | bool
|
|
|
|
- name: "🔐 CA | enforce permissions (private key)"
|
|
ansible.builtin.file:
|
|
path: "{{ CA_ROOT.key_host }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|