{"id":25839772,"url":"https://github.com/netresearch/ansible-certificates-from-vault","last_synced_at":"2025-03-01T04:34:23.160Z","repository":{"id":45283461,"uuid":"193459468","full_name":"netresearch/ansible-certificates-from-vault","owner":"netresearch","description":"Fetch SSL/TLS certificates from Hashicorp's Vault and store them on a host's filesystem.","archived":false,"fork":false,"pushed_at":"2021-12-28T09:39:42.000Z","size":24,"stargazers_count":6,"open_issues_count":0,"forks_count":5,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-04-15T02:08:15.150Z","etag":null,"topics":["ansible","hashicorp-vault","tls-certificates","vault-secret"],"latest_commit_sha":null,"homepage":"https://galaxy.ansible.com/netresearch/certificates_from_vault","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/netresearch.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-06-24T07:51:00.000Z","updated_at":"2023-02-21T10:33:08.000Z","dependencies_parsed_at":"2022-08-22T18:40:08.932Z","dependency_job_id":null,"html_url":"https://github.com/netresearch/ansible-certificates-from-vault","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netresearch%2Fansible-certificates-from-vault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netresearch%2Fansible-certificates-from-vault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netresearch%2Fansible-certificates-from-vault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netresearch%2Fansible-certificates-from-vault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/netresearch","download_url":"https://codeload.github.com/netresearch/ansible-certificates-from-vault/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241317608,"owners_count":19943199,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","hashicorp-vault","tls-certificates","vault-secret"],"created_at":"2025-03-01T04:34:22.289Z","updated_at":"2025-03-01T04:34:23.152Z","avatar_url":"https://github.com/netresearch.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Ansible role: TLS Certificates from Vault\n\nAn Ansible role that fetches SSL/TLS certificates and private keys from a\n[Hashicorp Vault](https://www.vaultproject.io/)\n[KV secrets engine](https://www.vaultproject.io/docs/secrets/kv/index.html) and\nstores them on a host's file system.\n\n\n## Requirements\n\n- **[hvac](https://pypi.org/project/hvac/)** - HashiCorp Vault API client for\nPython\n- Running **[Hashicorp Vault](https://www.vaultproject.io/)** instance\n\n**Currently supported operating systems:**\n- Debian 9\n- Ubuntu 18.04\n\n\n## Role Variables\n\n```YAML\nvault_url: \"http://myvault:8200\"\n```\nThe URL to the running Vault service.\n\n```YAML\nvault_path: \"secret/certificates\"\n```\nThe path to the folder of the KV secrets engine containing the certificate secrets.\n\n```YAML\nvault_token_string: \"{{\n  'token=' + VAULT_TOKEN if VAULT_TOKEN is defined and VAULT_TOKEN\n  else 'token=' + vault_token if vault_token is defined and vault_token\n  else ''\n}}\"\n```\nVault token parameter that is passed to the\n[hashi_vault](https://docs.ansible.com/ansible/latest/plugins/lookup/hashi_vault.html)\nlookup plugin. It is not intended to change this variable.\n\n```YAML\nvault_token:\n```\nThe Vault token for authentication within Vault. It is also possible to specify\nthe token within the `VAULT_TOKEN` environment variable.\n\n```YAML\nvault_secret_cert_keyname: \"cert\"\n```\nThe name of the key that contains the certificate (public key) within the Vault secret.\n\n```YAML\nvault_secret_key_keyname: \"key\"\n```\nThe name of the key that contains the private key within the Vault secret.\n\n```YAML\ncert_dest_dir: \"/etc/ssl/private\"\n```\nFile path to the directory on the host where certificates will be stored.\n\n```YAML\ncertificates:\n```\nList of secret names stored beneath `vault_path` containing fields for cert and private key.\n\n\n## Dependencies\n\nThis role does not depend on any other role from the Ansible Galaxy.\n\n\n## Example Playbook\n\n```YAML\n    - hosts: servers\n      vars:\n        vault_url: \"http://myvault:8200\"\n        vault_path: \"secret/certificates\"\n        certificates:\n          - www.example.org\n          - web1.example.org\n      roles:\n         - netresearch.certificates_from_vault\n```\n**Note:** It is assumed that the certificates are available as secrets in Vault\nat `secret/certificates/www.example.org` and\n`secret/certificates/web1.example.org`.\n\n\n## Local testing\nThe preferred way of locally testing the role is to use Docker. You will have\nto install Docker on your system.\n\nFor all our tests we use `test-kitchen` with\n`InSpec`. To install test-kitchen for Ubuntu 18.04:\n```bash\n$ sudo apt install ruby ruby-dev\n$ sudo gem install test-kitchen inspec kitchen-ansible kitchen-inspec kitchen-docker\n```\n\nPlease pass a valid Vault token to kitchen to fetch certificates from from your\nrunning Vault instance for testing:\n```\n$ export VAULT_TOKEN=s.abcdefghijklmn1234567890\n```\nRename `tests/test_vars.yml.dist` to `tests/test_vars.yml` and customized the\nvariables to your needs.\n\nFor starting the tests on all machines, please run:\n```bash\n$ kitchen test\n```\n\nFor development you can also run the test step-by-step for a particular OS:\n```bash\n# create vagrant boxes\n$ kitchen create debian\n\n# rollout Ansible config\n$ kitchen converge debian\n\n# start InSpec tests\n$ kitchen verify debian\n\n# login into vagrant box\n$ kitchen login debian\n```\n\n\n## License\n\nGNU Affero General Public License v3.0\n\n\n## Author Information\n\n[Norman Bestfleisch](https://github.com/Normo) | [Netresearch DTT GmbH](https://www.netresearch.de/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetresearch%2Fansible-certificates-from-vault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnetresearch%2Fansible-certificates-from-vault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetresearch%2Fansible-certificates-from-vault/lists"}