From 652e7ec99784444fe48a3aeae1344ef2f3cdb30a Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Sun, 7 Jan 2024 11:56:26 +0800
Subject: [PATCH] roles/cert-manager: add get_certificate.sh

---
 .../cert-manager/files/get_certificate.sh     | 28 +++++++++++++++++
 playbook/roles/cert-manager/tasks/main.yml    | 31 ++-----------------
 2 files changed, 30 insertions(+), 29 deletions(-)
 create mode 100644 playbook/roles/cert-manager/files/get_certificate.sh

diff --git a/playbook/roles/cert-manager/files/get_certificate.sh b/playbook/roles/cert-manager/files/get_certificate.sh
new file mode 100644
index 00000000..98e8c644
--- /dev/null
+++ b/playbook/roles/cert-manager/files/get_certificate.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+check_empty() {
+  if [ -z "$1" ]; then
+    echo "$2"
+    exit 1
+  fi
+}
+
+check_empty "$1" "Please provide DOMAIN" && DOMAIN=$1
+check_empty "$2" "Please provide VAULT_ADDR" && VAULT_ADDR=$2
+check_empty "$3" "Please provide VAULT_TOKEN" && VAULT_TOKEN=$3
+
+SECRET_PATH="certs/$DOMAIN"
+
+# Output paths
+CERTIFICATE_PATH="/etc/ssl/${DOMAIN}.pem"
+PRIVATE_KEY_PATH="/etc/ssl/${DOMAIN}.key"
+
+# Read certificate from Vault
+vault kv get -field=certificate certs/${DOMAIN} > "$CERTIFICATE_PATH"
+# Read private key from Vault
+vault kv get -field=private_key certs/${DOMAIN} > "$PRIVATE_KEY_PATH"
+
+# Set permissions for the private key (modify as needed)
+chmod 600 "$PRIVATE_KEY_PATH"
+
+echo "Certificate and private key have been written to $CERTIFICATE_PATH and $PRIVATE_KEY_PATH"
diff --git a/playbook/roles/cert-manager/tasks/main.yml b/playbook/roles/cert-manager/tasks/main.yml
index 0ba4a777..aeb6da13 100755
--- a/playbook/roles/cert-manager/tasks/main.yml
+++ b/playbook/roles/cert-manager/tasks/main.yml
@@ -2,33 +2,6 @@
   script: files/certs_automated_issuance.sh {{ domain }} {{ dns_ak }} {{ dns_sk }}
   when: (inventory_hostname in groups[group]) and (auto_issuance == true)
 
-#- name: certs automated issuance 
-#  script: files/fetch_certs_from_vault.py {{ domain }} {{ dns_ak }} {{ dns_sk }}
-#  when: (inventory_hostname in groups[group]) and (vault == true)
-
-- name: Fetch Certificate and Private Key from Vault
-  community.hashi_vault.vault_read:
-    url: "{{ vault_url }}"
-    token: "{{ vault_token }}"
-    path: "{{ vault_secret_path }}"
-  register: vault_result
+- name: certs automated issuance 
+  script: files/get_certificate.sh {{ domain }} {{ vault_url }} {{ vault_token }}
   when: (inventory_hostname in groups[group]) and (vault == true)
-
-- name: Write Certificate to File
-  ansible.builtin.copy:
-    content: "{{ vault_result.data.certificate }}"
-    dest: "/etc/ssl/{{ domain }}.pem"
-    owner: root
-    group: root
-    mode: '0644'
-  when: (inventory_hostname in groups[group]) and (vault == true)
-
-- name: Write Private Key to File
-  ansible.builtin.copy:
-    content: "{{ vault_result.data.private_key }}"
-    dest: "/etc/ssl/{{ domain }}.key"
-    owner: root
-    group: root
-    mode: '0600'
-  when: (inventory_hostname in groups[group]) and (vault == true)
-