ansible-role-step-ca/tasks/main.yml

---
- name: Copy Package to host
  copy:
    src: files/{{ item }}
    dest: "/opt/ansiblepackages/{{ item }}"
    owner: root
    group: root
    mode: '0600'
    backup: yes
  with_items:
    - step-cli_0.15.16_amd64.deb
    - step-ca_0.15.15_amd64.deb

- name: install package
  apt:
    deb: "/opt/ansiblepackages/{{ item }}"
  with_items:
    - step-cli_0.15.16_amd64.deb
    - step-ca_0.15.15_amd64.deb

- name: create user for step-ca
  user:
    name: step
    state: present
    shell: /bin/false
    system: yes
    createhome: yes
    home: /etc/step-ca

- name: generate /etc/step-ca/password.txt
  template:
    src: password.txt.j2
    dest: /etc/step-ca/password.txt
    owner: step
    group: step
    mode: "0770"

- name: link .step to /etc/step-ca
  file:
    state: link
    src: /etc/step-ca
    dest: ~/.step

- name: init step-ca
  command: step ca init --name="{{ pki_name }}" --dns {{ ansible_hostname }} --issuer="{{ pki_name }}" --address=:4343 --provisioner="{{ pki_name }}" --password-file=/etc/step-ca/password.txt --provisioner-password-file=/etc/step-ca/password.txt
  args:
    creates: /etc/step-ca/config

- name: create /etc/step-ca/db
  file:
    state: directory
    path: /etc/step-ca/db
    owner: step
    group: step
    mode: "0770"

- name: set permissions correct
  file:
    dest: /etc/step-ca
    owner: step
    group: step
    mode: "0770"
    recurse: yes

- name: correct paths
  replace:
    path: "{{ item }}"
    regexp: '\/root\/.step'
    replace: "\/etc\/step-ca"
  with_items:
  - /etc/step-ca/config/ca.json
  - /etc/step-ca/config/defaults.json

- name: generate /etc/systemd/system/step-ca.service
  template:
    src: step-ca.service.j2
    dest: /etc/systemd/system/step-ca.service
    owner: root
    group: root
    mode: "0644"
  notify:
    - reload systemd

- name: Flush handlers
  meta: flush_handlers

- name: enable step-ca
  systemd:
    name: step-ca
    enabled: yes
    masked: no

- name: list provisioners
  command: step ca provisioner list
  register: povisionerlist

- name: add acme provisioner
  command: step ca provisioner add acme --type ACME
  when: not povisionerlist.stdout.find ("ACME") != -1
  notify:
    - restart step-ca

- name: remove jwk provisioner
  command: step ca provisioner remove "{{ pki_name }}" --type JWK
  when: povisionerlist.stdout.find ("JWK") != -1
  notify:
    - restart step-ca