build

roles/cert_gen/tasks/main.yml

@@ -1,6 +1,9 @@
 - name: Cert gen
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
     - name: Create a directory for certs
       ansible.builtin.file:
         path: /tmp/certgen
@@ -58,19 +61,46 @@
 
     - name: Copy generated certs to files
       ansible.builtin.copy:
-        src: /tmp/certgen/ca.pem
+        src: /tmp/certgen/{{ cert1 }}
         dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
         remote_src: true
         mode: '0644'
         owner: jd
         group: root
       when: inventory_hostname != 'sectorq.cloud'
-      loop: 
+      loop_control:
+        loop_var: cert1
+      loop:
         - ca.pem
         - cert.pem
         - key.pem
-    - name: Restart docker service
-      ansible.builtin.systemd:
-        name: docker
-        state: restarted
 
+    - name: Install sshpass
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Create cert directory on nas server
+      ansible.builtin.command: |
+        sshpass -p {{ nas_password }} \
+        ssh  -p2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null admin@sectorq.eu "mkdir -p /share/Data/certs/docker/{{ inventory_hostname }}"
+      register: certgen
+      changed_when: "certgen.rc == 0"
+      ignore_errors: true
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Generate certs
+      ansible.builtin.command: |
+        sshpass -p {{ nas_password }} \
+        scp -P2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null {{ cert2 }} admin@sectorq.eu:/share/Data/certs/docker/{{ inventory_hostname }}/
+      register: certgen
+      changed_when: "certgen.rc == 0"
+      args:
+        chdir: /tmp/certgen
+      loop_control:
+        loop_var: cert2
+      loop:
+        - ca.pem
+        - cert.pem
+        - key.pem
+        - server-cert.pem
+        - server-key.pem