Ansible 2.8 support: Generate self-signed certificates

[tangrufus]

Follow up #1103

trellis/roles/wordpress-setup/tasks/self-signed-certificate.yml

Lines 3 to 16 in a36eb26

	shell: "openssl req -new -newkey rsa:2048 \
	-days 3650 -nodes -x509 -sha256 \
	-extensions req_ext -config <( \
	cat <<' EOF'\n
	[req]\n
	prompt = no\n
	distinguished_name = req_dn\n
	[req_dn]\n
	commonName = {{ item.value.site_hosts[0].canonical }}\n
	[req_ext]\n
	subjectAltName = {{ site_hosts | union(multisite_subdomains_wildcards) | map('regex_replace', '(.*)', 'DNS:\\1') | join(',') }}\n
	EOF\n
	) \
	-keyout {{ item.key | quote }}.key -out {{ item.key | quote }}.cert"

behaves differently since ansible 2.8

Ansible 2.7.13:

"cmd": "openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -sha256 -extensions req_ext -config <( cat <<' EOF'\n [req]\n prompt = no\n distinguished_name = req_dn\n [req_dn]\n commonName = typist.test\n [req_ext]\n subjectAltName = DNS:typist.test,DNS:www.typist.test\n EOF\n ) -keyout typist.tech.key -out typist.tech.cert",

Ansible 2.8.5:

"cmd": "openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -sha256 -extensions req_ext -config <( cat <<' EOF'\n[req]\nprompt = no\ndistinguished_name = req_dn\n[req_dn]\ncommonName = typist.test\n[req_ext]\nsubjectAltName = DNS:typist.test,DNS:www.typist.test\nEOF\n) -keyout typist.tech.key -out typist.tech.cert",

This pull request template the config files to {{ nginx_ssl_path }}/self-signed-openssl-configs/ temporarily instead of inlining cat.

Note: This pull request needs testing!

See:

• https://discourse.roots.io/t/self-signed-certificates-not-being-generated-in-development/16695/
• https://discourse.roots.io/t/bash-error-during-trellis-server-provisioning/14414/
• https://discourse.roots.io/t/generating-lets-encrypt-certificates-on-staging-fails/16684

[swalkinshaw]

Just to confirm, the difference was in spacing after newlines? And the lack of spacing broke something?

[swalkinshaw]

Tested and it generated the SSL cert 👍

[tangrufus]

Just to confirm, the difference was in spacing after newlines? And the lack of spacing broke something?

Yes and yes.

Besides templating to a temporary file, there are alertnatives: https://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-the-command-line
(Note: I didn't try these alertnatives)

[swalkinshaw]

A real template like this PR is much better than the complex/brittle shell script anyway I think 👍

[tangrufus]

Tested on some of my sites. Looks good to me.

Anything I have to do to get it merged?