feat ✨: Added detection of system's CA store path for various OS families
This commit introduces new tasks to detect and set the trusted CA store path based on the operating system family. The changes include adding support for Debian/Ubuntu, RedHat/CentOS/Fedora, macOS, and Windows systems. Additionally, it downloads Proxmox's SSL certificate and adds it to the system's trusted CA store.
This commit is contained in:
@@ -7,6 +7,64 @@
|
||||
node_ip: "{{ hostvars['node0']['ansible_host'] }}"
|
||||
|
||||
tasks:
|
||||
|
||||
- name: Detect the system's CA store path for Debian/Ubuntu
|
||||
ansible.builtin.set_fact:
|
||||
ca_store_path: "/etc/ssl/certs/"
|
||||
when: ansible_facts.os_family == "Debian"
|
||||
|
||||
- name: Detect the system's CA store path for RedHat/CentOS/Fedora
|
||||
ansible.builtin.set_fact:
|
||||
ca_store_path: "/etc/pki/tls/certs/"
|
||||
when: ansible_facts.os_family == "RedHat"
|
||||
|
||||
- name: Detect the system's CA store path for macOS
|
||||
ansible.builtin.set_fact:
|
||||
ca_store_path: "/System/Library/Keychains/SystemRootCertificates.keychain"
|
||||
when: ansible_facts.system == "Darwin"
|
||||
|
||||
- name: Detect the system's CA store path for Windows
|
||||
ansible.builtin.set_fact:
|
||||
ca_store_path: "Windows Certificate Store (use certmgr.msc)"
|
||||
when: ansible_facts.system == "Windows"
|
||||
|
||||
- name: Show the detected CA store path
|
||||
ansible.builtin.debug:
|
||||
msg: "The trusted CA store path is: {{ ca_store_path }}"
|
||||
|
||||
|
||||
|
||||
- name: Download Proxmox's SSL certificate
|
||||
ansible.builtin.get_url:
|
||||
url: "https://{{ node_ip }}:8006/pve2/cluster-ca.pem" # Assuming the Proxmox certificate URL
|
||||
dest: "/tmp/proxmox-ca.pem"
|
||||
mode: '0644'
|
||||
register: download_cert
|
||||
ignore_errors: yes # In case the certificate is already available locally
|
||||
|
||||
- name: Check if certificate was downloaded
|
||||
ansible.builtin.stat:
|
||||
path: "/tmp/proxmox-ca.pem"
|
||||
register: cert_stat
|
||||
|
||||
- name: Add the Proxmox certificate to the system's trusted CA store
|
||||
ansible.builtin.copy:
|
||||
src: "/tmp/proxmox-ca.pem"
|
||||
dest: "/usr/local/share/ca-certificates/proxmox-ca.crt"
|
||||
mode: '0644'
|
||||
when: cert_stat.stat.exists
|
||||
|
||||
- name: Update CA certificates (on Debian-based systems)
|
||||
ansible.builtin.command:
|
||||
cmd: update-ca-certificates
|
||||
when: cert_stat.stat.exists
|
||||
|
||||
- name: Restart Semaphore UI service to apply certificate change (if necessary)
|
||||
ansible.builtin.systemd:
|
||||
name: semaphore
|
||||
state: restarted
|
||||
when: cert_stat.stat.exists
|
||||
|
||||
- name: Install 'proxmoxer' and 'requests' Python libraries for the ansible controller
|
||||
ansible.builtin.pip:
|
||||
name:
|
||||
|
||||
Reference in New Issue
Block a user