pki: Use FQCN and general cleanup

roles/pki/tasks/main.yml

@@ -1,12 +1,11 @@
 ---
-
 - name: create hostkey group
-  group:
+  ansible.builtin.group:
     name: hostkey
     system: true
 
 - name: copy ca certificate
-  copy:
+  ansible.builtin.copy:
     src: "/srv/ca/certs/ca.crt"
     dest: "{{ tls_certs }}/ca.crt"
     mode: 0644
@@ -14,16 +13,24 @@
     group: "{{ ansible_wheel }}"
 
 - name: get ca certificate hash
-  command: "openssl x509 -in /srv/ca/certs/ca.crt -noout -hash"
+  ansible.builtin.command:
+    argv:
+      - openssl
+      - x509
+      - -in
+      - /srv/ca/certs/ca.crt
+      - -noout
+      - -hash
   delegate_to: localhost
   register: result
   changed_when: false
+
 - name: store ca certificate hash
-  set_fact:
+  ansible.builtin.set_fact:
     pki_cacert_hash: "{{ result.stdout }}"
 
 - name: copy host certificate
-  copy:
+  ansible.builtin.copy:
     src: "/srv/ca/certs/hosts/{{ inventory_hostname }}.crt"
     dest: "{{ tls_certs }}/{{ inventory_hostname }}.crt"
     mode: 0644
@@ -31,7 +38,7 @@
     group: "{{ ansible_wheel }}"
 
 - name: add ansible certificate fact
-  copy:
+  ansible.builtin.copy:
     content: |
       #!/bin/sh
       [ -f {{ tls_certs }}/{{ inventory_hostname }}.crt ] && awk '
@@ -45,15 +52,25 @@
     owner: root
     group: "{{ ansible_wheel }}"
 
-- name: create full chain of host certficate and ca
+- name: create full chain certificate contents
-  shell: "cat {{ tls_certs }}/{{ inventory_hostname }}.crt \
+  ansible.builtin.command:
-   {{ tls_certs }}/ca.crt > \
+    argv:
-   {{ tls_certs }}/{{ inventory_hostname }}-fullchain.crt"
+      - cat
-  args:
+      - "{{ tls_certs }}/{{ inventory_hostname }}.crt"
-    creates: "{{ tls_certs }}/{{ inventory_hostname }}-fullchain.crt"
+      - "{{ tls_certs }}/ca.crt"
+  changed_when: false
+  register: pki_host_fullchain
+
+- name: copy full chain certificate file
+  ansible.builtin.copy:
+    dest: "{{ tls_certs }}/{{ inventory_hostname }}-fullchain.crt"
+    content: "{{ pki_host_fullchain }}"
+    mode: 0640
+    owner: root
+    group: "{{ ansible_wheel }}"
 
 - name: copy host key
-  copy:
+  ansible.builtin.copy:
     src: "/srv/ca/private/{{ inventory_hostname }}.key"
     dest: "{{ tls_private }}/{{ inventory_hostname }}.key"
     mode: 0640