Add cacert role

Useful if you have to trust a local CA.

Author: jovial

ansible/.gitignore

@@ -32,6 +32,8 @@ roles/*
 !roles/mysql/**
 !roles/systemd/
 !roles/systemd/**
+!roles/cacerts/
+!roles/cacerts/**
 !roles/cuda/
 !roles/cuda/**
 !roles/freeipa/

ansible/bootstrap.yml

@@ -130,6 +130,14 @@
       - appliances_mode == 'configure'
       - not (dnf_repos_allow_insecure_creds | default(false)) # useful for development
 
+- hosts: cacerts
+  tags: cacerts
+  gather_facts: false
+  tasks:
+    - name: Install custom cacerts
+      import_role:
+        name: cacerts
+
 - hosts: squid
   tags: squid
   gather_facts: yes

ansible/roles/cacerts/tasks/install.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Install dependencies
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  become: true
+  with_items:
+    - ca-certificates

ansible/roles/cacerts/tasks/main.yml

@@ -0,0 +1,2 @@
+- import_tasks: install.yml
+- import_tasks: runtime.yml

ansible/roles/cacerts/tasks/runtime.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Copy all certificates
+  copy:
+    src: "{{ item }}"
+    dest: /etc/pki/ca-trust/source/anchors
+    owner: root
+    mode: 0644
+  with_fileglob:
+    - "{{ appliances_environment_root }}/cacerts"
+  become: true
+
+- name: Update trust store
+  command: update-ca-trust extract
+  become: true

ansible/roles/cacerts/tasks/validate.yml

@@ -0,0 +1,2 @@
+---
+