fix bugs&add new roles&update ssl generate

ansible/group_vars/all.yml

@@ -25,7 +25,7 @@ siteB:
   site_ip: "192.168.0.62"
 
 proxy:
-  proxy_domain: "proxy.example.com"
+  proxy_domain: "siteproxy.vlad"
   proxy_ip: "192.168.0.63"
 
 siteA_h2: "Новое сообщение для SiteA"

ansible/roles/firewall_cmd/handlers/main.yml

@@ -0,0 +1,2 @@
+- name: Restart firewalld
+  command: systemctl restart firewalld

ansible/roles/firewall_cmd/tasks/main.yml

@@ -0,0 +1,28 @@
+- name: Install firewalld
+  zypper:
+    name: firewalld
+    state: present
+  notify:
+    - Restart firewalld
+
+- name: Enable and start firewalld
+  command: systemctl enable --now firewalld
+  register: firewalld_enable
+  changed_when: "'Created symlink' in firewalld_enable.stdout or 'enabled' in firewalld_enable.stdout"
+  notify:
+    - Restart firewalld
+
+- name: Open specified firewall ports permanently
+  loop: "{{ firewall_ports }}"
+  command: firewall-cmd --permanent --add-port={{ item.port }}/{{ item.protocol }}
+  register: firewalld_add_port
+  changed_when: "'success' in firewalld_add_port.stdout"
+  notify:
+    - Restart firewalld
+
+- name: Reload firewalld rules
+  command: firewall-cmd --reload
+  register: firewalld_reload
+  changed_when: "'success' in firewalld_reload.stdout"
+  notify:
+    - Restart firewalld

ansible/roles/firewall_cmd/vars/main.yml

@@ -0,0 +1,4 @@
+firewall_ports:
+  - { port: 22, protocol: tcp }
+  - { port: 80, protocol: tcp }
+  - { port: 443, protocol: tcp }

ansible/roles/ssl_certificate/tasks/main.yml

@@ -1,22 +1,38 @@
-- name: Install OpenSSL
+- name: Install OpenSSL
-  zypper:
+  ansible.builtin.zypper:
-    name: openssl
+    name: openssl
-    state: present
+    state: present
-
+
-- name: Create SSL directory
+- name: Create SSL directory
-  file:
+  ansible.builtin.file:
-    path: "{{ ssl_cert_path }}"
+    path: "{{ ssl_cert_path }}"
-    state: directory
+    state: directory
-    owner: root
+    owner: root
-    group: root
+    group: root
-    mode: '0755'
+    mode: '0755'
-
+
-- name: Generate Self-Signed SSL Certificate
+- name: Generate private key
-  command: >
+  community.crypto.openssl_privatekey:
-    openssl req -x509 -nodes -days 365
+    path: "{{ ssl_cert_path }}/{{ ssl_key_file }}"
-    -newkey rsa:2048
+    size: 2048
-    -keyout {{ ssl_cert_path }}/{{ ssl_key_file }}
+    type: RSA
-    -out {{ ssl_cert_path }}/{{ ssl_cert_file }}
+    mode: '0600'
-    -subj "{{ ssl_subject }}"
+
-  args:
+- name: Generate CSR (Certificate Signing Request)
-    creates: "{{ ssl_cert_path }}/{{ ssl_cert_file }}"
+  community.crypto.openssl_csr:
+    path: "{{ ssl_cert_path }}/{{ ssl_csr_file }}"
+    privatekey_path: "{{ ssl_cert_path }}/{{ ssl_key_file }}"
+    common_name: "{{ ssl_common_name }}"
+    country_name: "{{ ssl_country }}"
+    state_or_province_name: "{{ ssl_state }}"
+    locality_name: "{{ ssl_locality }}"
+    organization_name: "{{ ssl_organization }}"
+    organizational_unit_name: "{{ ssl_organizational_unit }}"
+
+- name: Generate Self-Signed SSL Certificate
+  community.crypto.x509_certificate:
+    path: "{{ ssl_cert_path }}/{{ ssl_cert_file }}"
+    privatekey_path: "{{ ssl_cert_path }}/{{ ssl_key_file }}"
+    csr_path: "{{ ssl_cert_path }}/{{ ssl_csr_file }}"
+    provider: selfsigned
+    force: yes

ansible/roles/ssl_certificate/vars/main.yml

@@ -1,4 +1,11 @@
-ssl_cert_path: "/etc/nginx/ssl"
+ssl_cert_path: "/etc/nginx/ssl"
-ssl_cert_file: "proxy.crt"
+ssl_cert_file: "proxy.crt"
-ssl_key_file: "proxy.key"
+ssl_key_file: "proxy.key"
-ssl_subject: "/C=RU/ST=Some-State/L=Some-City/O=Your Company/CN={{ proxy.proxy_domain }}"
+ssl_csr_file: "proxy.csr"
+
+ssl_common_name: "{{ proxy.proxy_domain }}"
+ssl_country: "RU"
+ssl_state: "Some-State"
+ssl_locality: "Some-City"
+ssl_organization: "Your Company"
+ssl_organizational_unit: "IT"

ansible/roles/ssl_certificate_cmd/tasks/main.yml

@@ -0,0 +1,20 @@
+- name: Install OpenSSL
+  zypper:
+    name: openssl
+    state: present
+
+- name: Create SSL directory
+  file:
+    path: "{{ ssl_cert_path }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: Generate Self-Signed SSL Certificate
+  command: >
+    openssl req -x509 -nodes -days 365
+    -newkey rsa:2048
+    -keyout {{ ssl_cert_path }}/{{ ssl_key_file }}
+    -out {{ ssl_cert_path }}/{{ ssl_cert_file }}
+    -subj "{{ ssl_subject }}"

ansible/roles/ssl_certificate_cmd/vars/main.yml

@@ -0,0 +1,4 @@
+ssl_cert_path: "/etc/nginx/ssl"
+ssl_cert_file: "proxy.crt"
+ssl_key_file: "proxy.key"
+ssl_subject: "/C=RU/ST=Some-State/L=Some-City/O=Your Company/CN={{ proxy.proxy_domain }}"