Consolidate rsyslog_ca files.

rsyslog_ca.pem and rsyslogclientca.crt where the same file.  Now just use a single source file and put it in a single location.

Author: baszoetekouw

roles/rsyslog/tasks/main.yml

@@ -1,3 +1,12 @@
+- name: remove old files:
+  ansible.builtin.file:
+    path: "/etc/pki/rsyslog/{{  item }}"
+    state: "absent"
+  loop:
+    - "rsyslogclientca.crt"
+    - "rsyslogclientcaprd.crt"
+    - "rsyslogclientprd.crt"
+
 - name: Install rsyslog and python modules
   ansible.builtin.package:
     name:
@@ -80,11 +89,11 @@
       notify:
         - "restart rsyslog"
 
-    - name: Put rsyslog CA file (new location)
+    - name: Put rsyslog CA file
       ansible.builtin.copy:
-        src: "{{ inventory_dir }}/files/certs/rsyslog/rsyslogclientca.crt"
-        dest: "{{ rsyslog_certifcate_dir }}/rsyslogclientca.crt"
-        mode: "0744"
+        src: "{{ inventory_dir }}/files/certs/rsyslog/rsyslog_ca.crt"
+        dest: "{{ rsyslog_ca }}"
+        mode: "0644"
         owner: root
         group: adm
 

roles/rsyslog/tasks/rsyslog_central.yml

@@ -20,19 +20,22 @@
     mode: "0750"
     # recurse: true # this makes everything very slow and not sure if it is necessary
 
-- name: Put rsyslog client certificate
+- name: Put rsyslog server certificate
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/files/certs/rsyslog/rsyslogserver.crt"
     dest: "/etc/pki/rsyslog/rsyslogserver.crt"
     mode: "0644"
     owner: root
     group: adm
 
-- name: Place rsyslog CA file
+- name: Put rsyslog CA file
   ansible.builtin.copy:
-    src: "{{ inventory_dir }}/files/certs/rsyslog_ca.pem"
+    src: "{{ inventory_dir }}/files/certs/rsyslog/rsyslog_ca.crt"
     dest: "{{ rsyslog_ca }}"
     mode: "0644"
+    owner: root
+    group: adm
+
 
 - name: Create directories to keep configuration file
   ansible.builtin.file:

roles/rsyslog/templates/rsyslog.conf.j2

@@ -108,7 +108,7 @@ action(type="omrelp"
 target="{{ rsyslog_remote_server_relp }}" 
 port="{{ rsyslog_remote_relp_port }}" 
 tls="on" 
-tls.caCert="/etc/pki/rsyslog/rsyslogclientca.crt" 
+tls.caCert="{{ rsyslog_ca }}"
 tls.MyCert="/etc/pki/rsyslog/rsyslogclient.crt"
 tls.MyPrivKey="/etc/pki/rsyslog/rsyslogclient.key"
 tls.authmode="name" 

roles/rsyslog/templates/rsyslog_onlyforward.conf.j2

@@ -34,7 +34,7 @@ action(type="omrelp"
 target="{{ relp_host.host }}"
 port="{{ relp_host.port }}"
 tls="on"
-tls.caCert="/etc/pki/rsyslog/rsyslogclientca.crt"
+tls.caCert="{{ rsyslog_ca }}"
 tls.MyCert="/etc/pki/rsyslog/rsyslogclient.crt"
 tls.MyPrivKey="/etc/pki/rsyslog/rsyslogclient.key"
 tls.authmode="name"