argument_specs.yml

---

argument_specs:
  main:
    short_description: Variables for tasks/main.yml entrypoint
    options:
      easyrsa_enabled:
        type: bool
        default: true
        description: "Set to false to completely disable the role."

      # Installation {{{
      easyrsa_repo:
        type: str
        default: 'https://github.com/OpenVPN/easy-rsa'
        description: 'The git repo url to download easy-rsa from.'

      easyrsa_version:
        type: str
        default: master
        description: |
          The version of easy-rsa to install. This can be any branch name or tag
          from the easy-rsa repo. See:
          - https://github.com/OpenVPN/easy-rsa/tags
          - https://github.com/OpenVPN/easy-rsa/branches

      easyrsa_pki_dir:
        type: str
        default: /etc/easyrsa/pki
        description: "The folder on the host where certs, keys etc will be located."

      easyrsa_replace_pki:
        type: bool
        default: false
        description: |
          Set to true to delete any existing easy-rsa PKI on the host and create
          a new, fresh one.
      # }}}
      # Configuration {{{
      # All variables in this section correspond to the EASYRSA_* variables
      # defined in the `vars` file that easyrsa uses. The documentation of these
      # variables is available in the `vars.j2` file that comes with the role.
      easyrsa_conf_temp_dir:
        type: str
        default: '.'
      easyrsa_conf_dn:
        type: str
        default: "cn_only"
      easyrsa_conf_req_country:
        type: str
        default: "US"
      easyrsa_conf_req_province:
        type: str
        default: "California"
      easyrsa_conf_req_city:
        type: str
        default: "San Francisco"
      easyrsa_conf_req_org:
        type: str
        default: "Copyleft Certificate Co"
      easyrsa_conf_req_email:
        type: str
        default: "me@example.net"
      easyrsa_conf_req_ou:
        type: str
        default: "My Organizational Unit"

      easyrsa_conf_req_cn:
        type: str
        default: "ChangeMe"
        description: |
          This is used when building the CA. The role manually sets the CN for each
          server and client certificate, thus disregarding this default value.

      easyrsa_conf_key_size:
        type: str
        default: 2048
      easyrsa_conf_algo:
        type: str
        default: rsa
      easyrsa_conf_curve:
        type: str
        default: secp384r1
      easyrsa_conf_digest:
        type: str
        default: sha256

      easyrsa_conf_ca_expire:
        type: str
        default: 3650
      easyrsa_conf_cert_expire:
        type: str
        default: 1080
      easyrsa_conf_cert_renew:
        type: str
        default: 30
      easyrsa_conf_crl_days:
        type: str
        default: 180
      easyrsa_conf_rand_sn:
        type: str  # Careful! This is a string, not a boolean
        default: "yes"
      easyrsa_conf_ns_support:
        type: str  # Careful! This is a string, not a boolean
        default: "no"
      easyrsa_conf_ns_comment:
        type: str
        default: "Easy-RSA Generated Certificate"

      easyrsa_conf_temp_file:
        type: str
        default: "$EASYRSA_TEMP_DIR/extensions.temp"
      easyrsa_conf_ext_dir:
        type: str
        default: "$EASYRSA/x509-types"
      easyrsa_conf_ssl_conf:
        type: str
        default: "$EASYRSA/openssl-easyrsa.cnf"
      # }}}
      # Certificates {{{
      easyrsa_servers:
        type: list
        required: false
        description: "A list of server certificates (and private keys) to create."
        options:
          name:
            required: true
            type: str
            description: "A name for the server certificate."
          pass:
            required: false
            type: str
            description: "A passphrase to encrypt the private key."
          cn:
            required: false
            type: str
            description: "The Common Name for this server. If None, `name` will be used instead."

      easyrsa_clients:
        type: list
        required: false
        description: "A list of client certificates (and private keys) to create."
        options:
          name:
            required: true
            type: str
            description: "A name for the client certificate."
          pass:
            required: false
            type: str
            description: "A passphrase to encrypt the private key."
          cn:
            required: false
            type: str
            description: "The Common Name for this client. If None, `name` will be used instead."

      easyrsa_renew:
        type: list
        required: false
        description: "A list of existing certificates to renew."
        options:
          name:
            type: str
            required: true
            description: "The name of the certificate to renew."

      easyrsa_revoke_old:
        type: list
        required: false
        description: "A list of renewed ceritificates whose old version should be revoked."
        options:
          name:
            type: str
            required: true
            description: "The name of the certificate whose old version to revoke."
          reason:
            type: str
            default: 'unspecified'
            description: "The reason that this certificate was revoked."

      easyrsa_revoked:
        type: list
        required: false
        description: "A list of revoked certificates."
        options:
          name:
            type: str
            required: true
            description: "The name of the certificate to revoke."
          reason:
            type: str
            default: 'unspecified'
            description: "The reason that this certificate was revoked."
      # }}}
      # Download {{{
      easyrsa_download:
        type: list
        required: false
        description:
          'A list of specific certificates (and keys) to download, e.g. {{ easyrsa_clients }}.'

      easyrsa_crl_handlers:
        type: list
        required: false
        description: 'A list of handlers to run after a new CRL has been generated.'

      easyrsa_download_pki:
        type: bool
        default: false
        description: |
          Set to true to download the whole pki folder as a zip folder to the Ansible
          controller. Perhaps you want to set `easyrsa_download` to an empty list to not
          download certificates/keys twice.

      easyrsa_download_pki_extract:
        type: bool
        default: true
        description: 'Set to true to extract the downloaded pki.'

      easyrsa_download_dir:
        type: str
        default: '/tmp/'
        description: 'Where to download the certificates/keys to the Ansible controller.'

      easyrsa_download_user:
        type: str
        default: "{{ lookup('pipe', 'id -un') }}"
        description: 'The user that will own the downloaded certs/keys.'

      easyrsa_download_group:
        type: str
        default: "{{ lookup('pipe', 'id -gn') }}"
        description: 'The group that will own the downloaded certs/keys.'
      # }}}
      # Conversions {{{
      # These features require EasyRSA version > 3.0.8
      easyrsa_to_pkcs12:
        type: list
        required: false
        description: |
          A list of certificate names to convert to the PKCS#12 format. If you do not
          specify a passphrase for a key in this list, no pkcs12 file will be
          generated as PKCS#12 requires a passphrase. Example:
            easyrsa_to_pkcs12: "{{ easyrsa_servers }}"
        options:
          name:
            required: true
            type: str
            description: "The name of the certificate (and corresponding key) to convert."
          pass:
            required: true
            type: str
            description: "A passphrase to encrypt the generated PKCS#12 file."

      easyrsa_to_pkcs8:
        type: list
        required: false
        description: |
          A list of certificate names whose corresponding private key to convert
          to the PKCS#8 format. Eg:
            easyrsa_to_pkcs8: "{{ easyrsa_servers }}"
        options:
          name:
            required: true
            type: str
            description: "The name of the certificate whose private key to convert."
          pass:
            required: false
            type: str
            description: "A passphrase to encrypt the converted key."

      easyrsa_to_pkcs7:
        type: list
        required: false
        description: |
          A list of certificate names to convert to the PKCS#7 format. Eg:
            easyrsa_to_pkcs7: "{{ easyrsa_servers }}"
        options:
          name:
            required: true
            type: str
            description: "The name of the certificate to convert."

      easyrsa_to_pkcs1:
        type: list
        required: false
        description: |
          A list of certificate names whose corresponding private key to convert
          to the PKCS#1 (RSA) format. Eg:
            easyrsa_to_pkcs1: "{{ easyrsa_servers }}"
        options:
          name:
            required: true
            type: str
            description: "The name of the certificate whose private key to convert."
          pass:
            required: false
            type: str
            description: "A passphrase to encrypt the converted key."
      # }}}
      # Other {{{
      easyrsa_generate_dh:
        type: bool
        default: false
        description: "Set to true to generate Diffie-Hellman parameters."
        # }}}