1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
|
#!/usr/bin/python
# Copyright: (c) 2020, Hetzner Cloud GmbH <info@hetzner-cloud.de>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
from __future__ import annotations
DOCUMENTATION = """
---
module: certificate
short_description: Create and manage certificates on the Hetzner Cloud.
description:
- Create, update and manage certificates on the Hetzner Cloud.
author:
- Lukas Kaemmerling (@lkaemmerling)
options:
id:
description:
- The ID of the Hetzner Cloud certificate to manage.
- Only required if no certificate I(name) is given
type: int
name:
description:
- The Name of the Hetzner Cloud certificate to manage.
- Only required if no certificate I(id) is given or a certificate does not exist.
type: str
labels:
description:
- User-defined labels (key-value pairs)
type: dict
certificate:
description:
- Certificate and chain in PEM format, in order so that each record directly certifies the one preceding.
- Required if certificate does not exist and I(type=uploaded).
type: str
private_key:
description:
- Certificate key in PEM format.
- Required if certificate does not exist and I(type=uploaded).
type: str
domain_names:
description:
- Domains and subdomains that should be contained in the Certificate issued by Let's Encrypt.
- Required if I(type=managed).
type: list
default: [ ]
elements: str
type:
description:
- Choose between uploading a Certificate in PEM format or requesting a managed Let's Encrypt Certificate.
default: uploaded
choices: [ uploaded, managed ]
type: str
state:
description:
- State of the certificate.
default: present
choices: [ absent, present ]
type: str
extends_documentation_fragment:
- hetzner.hcloud.hcloud
"""
EXAMPLES = """
- name: Create a basic certificate
hetzner.hcloud.certificate:
name: my-certificate
certificate: -----BEGIN CERTIFICATE-----...
private_key: -----BEGIN PRIVATE KEY-----...
state: present
- name: Create a certificate with labels
hetzner.hcloud.certificate:
name: my-certificate
certificate: -----BEGIN CERTIFICATE-----...
private_key: -----BEGIN PRIVATE KEY-----...
labels:
key: value
mylabel: 123
state: present
- name: Create a managed certificate
hetzner.hcloud.certificate:
name: my-certificate
type: managed
domain_names:
- example.com
- www.example.com
state: present
- name: Ensure the certificate is absent (remove if needed)
hetzner.hcloud.certificate:
name: my-certificate
state: absent
"""
RETURN = """
hcloud_certificate:
description: The certificate instance
returned: Always
type: complex
contains:
id:
description: Numeric identifier of the certificate
returned: always
type: int
sample: 1937415
name:
description: Name of the certificate
returned: always
type: str
sample: my website cert
fingerprint:
description: Fingerprint of the certificate
returned: always
type: str
sample: "03:c7:55:9b:2a:d1:04:17:09:f6:d0:7f:18:34:63:d4:3e:5f"
certificate:
description: Certificate and chain in PEM format
returned: always
type: str
sample: "-----BEGIN CERTIFICATE-----..."
domain_names:
description: List of Domains and Subdomains covered by the Certificate
returned: always
type: dict
not_valid_before:
description: Point in time when the Certificate becomes valid (in ISO-8601 format)
returned: always
type: str
not_valid_after:
description: Point in time when the Certificate stops being valid (in ISO-8601 format)
returned: always
type: str
labels:
description: User-defined labels (key-value pairs)
returned: always
type: dict
"""
from ansible.module_utils.basic import AnsibleModule
from ..module_utils.hcloud import AnsibleHCloud
from ..module_utils.vendor.hcloud import HCloudException
from ..module_utils.vendor.hcloud.certificates import BoundCertificate
class AnsibleHCloudCertificate(AnsibleHCloud):
represent = "hcloud_certificate"
hcloud_certificate: BoundCertificate | None = None
def _prepare_result(self):
return {
"id": str(self.hcloud_certificate.id),
"name": self.hcloud_certificate.name,
"type": self.hcloud_certificate.type,
"fingerprint": self.hcloud_certificate.fingerprint,
"certificate": self.hcloud_certificate.certificate,
"not_valid_before": self.hcloud_certificate.not_valid_before.isoformat(),
"not_valid_after": self.hcloud_certificate.not_valid_after.isoformat(),
"domain_names": self.hcloud_certificate.domain_names,
"labels": self.hcloud_certificate.labels,
}
def _get_certificate(self):
try:
if self.module.params.get("id") is not None:
self.hcloud_certificate = self.client.certificates.get_by_id(self.module.params.get("id"))
elif self.module.params.get("name") is not None:
self.hcloud_certificate = self.client.certificates.get_by_name(self.module.params.get("name"))
except HCloudException as exception:
self.fail_json_hcloud(exception)
def _create_certificate(self):
self.module.fail_on_missing_params(required_params=["name"])
params = {
"name": self.module.params.get("name"),
"labels": self.module.params.get("labels"),
}
if self.module.params.get("type") == "uploaded":
self.module.fail_on_missing_params(required_params=["certificate", "private_key"])
params["certificate"] = self.module.params.get("certificate")
params["private_key"] = self.module.params.get("private_key")
if not self.module.check_mode:
try:
self.client.certificates.create(**params)
except HCloudException as exception:
self.fail_json_hcloud(exception)
else:
self.module.fail_on_missing_params(required_params=["domain_names"])
params["domain_names"] = self.module.params.get("domain_names")
if not self.module.check_mode:
try:
resp = self.client.certificates.create_managed(**params)
# Action should take 60 to 90 seconds on average, wait for 5m to
# allow DNS or Let's Encrypt slowdowns.
resp.action.wait_until_finished(max_retries=300)
except HCloudException as exception:
self.fail_json_hcloud(exception)
self._mark_as_changed()
self._get_certificate()
def _update_certificate(self):
try:
name = self.module.params.get("name")
if name is not None and self.hcloud_certificate.name != name:
self.module.fail_on_missing_params(required_params=["id"])
if not self.module.check_mode:
self.hcloud_certificate.update(name=name)
self._mark_as_changed()
labels = self.module.params.get("labels")
if labels is not None and self.hcloud_certificate.labels != labels:
if not self.module.check_mode:
self.hcloud_certificate.update(labels=labels)
self._mark_as_changed()
except HCloudException as exception:
self.fail_json_hcloud(exception)
self._get_certificate()
def present_certificate(self):
self._get_certificate()
if self.hcloud_certificate is None:
self._create_certificate()
else:
self._update_certificate()
def delete_certificate(self):
self._get_certificate()
if self.hcloud_certificate is not None:
if not self.module.check_mode:
try:
self.client.certificates.delete(self.hcloud_certificate)
except HCloudException as exception:
self.fail_json_hcloud(exception)
self._mark_as_changed()
self.hcloud_certificate = None
@classmethod
def define_module(cls):
return AnsibleModule(
argument_spec=dict(
id={"type": "int"},
name={"type": "str"},
type={
"choices": ["uploaded", "managed"],
"default": "uploaded",
},
domain_names={"type": "list", "elements": "str", "default": []},
certificate={"type": "str"},
private_key={"type": "str", "no_log": True},
labels={"type": "dict"},
state={
"choices": ["absent", "present"],
"default": "present",
},
**super().base_module_arguments(),
),
required_one_of=[["id", "name"]],
required_if=[["state", "present", ["name"]]],
supports_check_mode=True,
)
def main():
module = AnsibleHCloudCertificate.define_module()
hcloud = AnsibleHCloudCertificate(module)
state = module.params.get("state")
if state == "absent":
hcloud.delete_certificate()
elif state == "present":
hcloud.present_certificate()
module.exit_json(**hcloud.get_result())
if __name__ == "__main__":
main()
|
