install local ca signed host certificates for all hosts

roles/base/tasks/main.yml

@@ -12,4 +12,9 @@
 
 - name: install basic roles
   include_role:
-    name: opensmtpd
+    name: "{{ role }}"
+  with_items:
+    - opensmtpd
+    - pki
+  loop_control:
+    loop_var: role

roles/pki/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+
+- name: copy ca certificate
+  copy:
+    src: "/srv/ca/certs/ca.crt"
+    dest: "/etc/pki/tls/certs/ca.crt"
+    mode: 0644
+    owner: root
+    group: root
+
+- name: copy host certificate
+  copy:
+    src: "/srv/ca/certs/{{ inventory_hostname }}.crt"
+    dest: "/etc/pki/tls/certs/{{ inventory_hostname }}.crt"
+    mode: 0644
+    owner: root
+    group: root
+
+- name: copy host key
+  copy:
+    src: "/srv/ca/private/{{ inventory_hostname }}.key"
+    dest: "/etc/pki/tls/private/{{ inventory_hostname }}.key"
+    mode: 0600
+    owner: root
+    group: root