Generate a self-signed cert when none is provided #35
Conversation
| umask 022; | ||
| cat /etc/ssl/certs/wildcard_public_cert.crt /etc/ssl/certs/wildcard_ca.pem > | ||
| /etc/ssl/certs/wildcard_combined.pem | ||
| creates=/etc/ssl/certs/wildcard_combined.pem |
There was a problem hiding this comment.
Won't it interpret this as part of the script since this is the same level of indentation?
There was a problem hiding this comment.
Nope! http://docs.ansible.com/shell_module.html
You can provide key=value pairs at the end of a shell command.
| shell: > | ||
| umask 022; | ||
| ln /etc/ssl/certs/wildcard_public_cert.crt | ||
| /etc/ssl/certs/wildcard_combined.pem |
There was a problem hiding this comment.
@PiPeep Shouldn't this be a symlink, not a hard link?
|
@PiPeep 👍 Finished my review. Some replies and maybe one more commit will be enough to merge it! Great job on this, and sorry for taking a little longer to review it! |
| -signkey /etc/ssl/private/wildcard_private.key | ||
| -out /etc/ssl/certs/wildcard_public_cert.crt | ||
| args: | ||
| creates: /etc/ssl/certs/wildcard_public_cert.crt |
There was a problem hiding this comment.
It's going all over the place! ick
It would be better to have all the cert stuff placed in one folder, so that users only have one place to go to delete the stuff, and then they can re-run the script to generate a new keypair.
There was a problem hiding this comment.
I think this should be a separate PR.
The documentation suggested doing this manually, but this is better because it does it for you!
| # https://github.com/ansible/ansible/issues/3107 | ||
| - name: Find existing SSL keys | ||
| sudo: no | ||
| local_action: command test -e roles/common/files/wildcard_private.key |
There was a problem hiding this comment.
This key should be in a folder that in the top level directory, not buried deeply within the roles.
|
OK, created issue #37 to address the issues I saw here, but this is good to merge (I think). Just waiting for @PiPeep's vagrant test results. |
Generate a self-signed cert when none is provided
The documentation suggested doing this manually, but this is better because it does it for you!