damex / ansible-collections-cloudflare Goto Github PK

it is good enough for some simple use cases and works well.

it is currently in beta and there is no api present/documented.

need to wait till it gets api support (i guess it is there but no public documentation present yet) and then implement corresponding automation here.

currently we can only make new certificates but do no revoke old ones.

there is no clear implementation path for this problem since acme does not support revocation by domain and can't always guarantee existence of domain key+certificate (and we do not even know if domain certificate exists).

we need to implement certificate revocation in the most compatible and user friendly way possible.

so it is possible security concern.
we need to disable authz when block with certificate fails (rescue?) and have it deactivated (by default) after issuing a certificate.

so currently we have a cloudflare_acme role that ensures certificate directory, acme account and go all the way to ensure acme certificates for domains in each zone.

it should not happen unconditionally like it happen now.
what we need to do is to add smart condition for this role to be skipped when cloudflare_acme_zones list is empty.

possible solutions to be evaluated but block with when condition should be considered last.

https://docs.ansible.com/ansible/latest/collections/community/crypto/acme_certificate_module.html#parameter-account_key_passphrase

that's it. now it is passwordless key and we can keep password for it natively in inventory + ansible vault.
that would protect key if someone would want to snoop around ;)