Support using existing SSL certs on system

Add the additional pvc_api_ssl_cert_path and pvc_api_ssl_key_path
group_vars options, which can be used to set the SSL details to existing
files on the filesystem if desired. If these are empty (or nonexistent),
the original pvc_api_ssl_cert and pvc_api_ssl_key raw format options
will be used as they were.

Allows the administrator to use outside methods (such as Let's Encrypt)
to obtain the certs locally on the system, avoiding changes to the
group_vars and redeployment to manage SSL keys.
This commit is contained in:
2023-09-01 15:42:24 -04:00
parent a8419be587
commit f79fb605de
3 changed files with 25 additions and 4 deletions

View File

@ -27,7 +27,7 @@
dest: /etc/pvc/api-cert.pem
mode: 0644
no_log: True
when: pvc_api_enable_ssl
when: pvc_api_enable_ssl and not pvc_api_ssl_cert_path
- name: install API SSL key file
copy:
@ -35,7 +35,7 @@
dest: /etc/pvc/api-key.pem
mode: 0640
no_log: True
when: pvc_api_enable_ssl
when: pvc_api_enable_ssl and not pvc_api_ssl_key_path
- name: stop and disable unneccessary services
service: