mongodb: Better way to create combined cert/key

roles/mongodb/tasks/main.yml

@@ -55,23 +55,23 @@
     state: link
     follow: false
 
-- name: create combined certificate/private key file
+- name: generate combined certificate/private key file contents
-  ansible.builtin.shell:
+  ansible.builtin.command:
-    cmd: >-
+    argv:
-      umask 077 &&
+      - /bin/cat
-      /bin/cat \
+      - "{{ tls_certs }}/{{ inventory_hostname }}.crt"
-          {{ tls_certs }}/{{ inventory_hostname }}.crt \
+      - "{{ tls_private }}/{{ inventory_hostname }}.key"
-          {{ tls_private }}/{{ inventory_hostname }}.key > \
+  failed_when: false
-          {{ tls_private }}/mongodb.pem
+  register: mongodb_cert_key
-    creates: "{{ tls_private }}/mongodb.pem"
-  notify: restart mongod
 
-- name: fix certificate/key file permissions
+- name: create combined certificate/private key file
-  ansible.builtin.file:
+  ansible.builtin.copy:
-    path: "{{ tls_private }}/mongodb.pem"
+    dest: "{{ tls_private }}/mongodb.pem"
+    content: "{{ mongodb_cert_key.stdout }}"
     mode: 0640
     owner: root
     group: mongod
+  notify: restart mongod
 
 - name: configure logrotate
   ansible.builtin.copy: