Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

roles/mtls/README.md

@@ -0,0 +1,7 @@
+# mtls
+
+Prepares trust directories and deploys externally issued CA certificates, host
+certificates, and private keys. This role does not generate certificates.
+
+Tags: `mtls`, `pki`.
+

roles/mtls/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+mtls_ca_certificates: []
+mtls_host_certificates: []
+mtls_private_keys: []
+mtls_ca_directory: /usr/local/share/ca-certificates/internal
+mtls_cert_directory: /etc/pki/internal/certs
+mtls_private_directory: /etc/pki/internal/private
+

roles/mtls/files/.gitkeep

@@ -0,0 +1 @@
+

roles/mtls/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: update ca certificates
+  ansible.builtin.command:
+    cmd: update-ca-certificates
+  changed_when: true
+

roles/mtls/tasks/main.yml

@@ -0,0 +1,48 @@
+---
+- name: Ensure mTLS directories exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "{{ item.mode }}"
+  loop:
+    - { path: "{{ mtls_ca_directory }}", mode: "0755" }
+    - { path: "{{ mtls_cert_directory }}", mode: "0755" }
+    - { path: "{{ mtls_private_directory }}", mode: "0700" }
+  tags: [mtls, pki]
+
+- name: Deploy trusted CA certificates
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ mtls_ca_directory }}/{{ item.name }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ mtls_ca_certificates }}"
+  notify: update ca certificates
+  no_log: "{{ item.no_log | default(false) }}"
+  tags: [mtls, pki]
+
+- name: Deploy host certificates
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ mtls_cert_directory }}/{{ item.name }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ mtls_host_certificates }}"
+  no_log: "{{ item.no_log | default(false) }}"
+  tags: [mtls, pki]
+
+- name: Deploy host private keys
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ mtls_private_directory }}/{{ item.name }}"
+    owner: root
+    group: root
+    mode: "0600"
+  loop: "{{ mtls_private_keys }}"
+  no_log: true
+  tags: [mtls, pki]
+

roles/mtls/templates/.gitkeep

@@ -0,0 +1 @@
+