panel: add SAN to cert, ensure cert is tested (#155)

roles/pterodactyl_panel/molecule/default/converge.yml

@@ -0,0 +1,7 @@
+---
+- name: Converge
+  hosts: panel
+  tasks:
+    - name: "Include pterodactyl_panel"
+      include_role:
+        name: "pterodactyl_panel"

roles/pterodactyl_panel/molecule/default/molecule.yml

@@ -79,13 +79,14 @@ platforms:
     network: molecule-pterodactyl-panel
 
 provisioner:
-  playbooks:
-    converge: ../converge.yml
-    verify: ../verify.yml
   inventory:
     group_vars:
       all:
         pterodactyl_panel_webroot: /var/www/pterodactyl-molecule
+        pterodactyl_panel_domain: "{{ ansible_fqdn }}"
+        pterodactyl_panel_ssl_mode: selfsign
+        pterodactyl_panel_ssl_cert: /etc/ssl/selfsign-test.crt
+        pterodactyl_panel_ssl_key: /etc/ssl/selfsign-test.key
         pterodactyl_panel_app_key: base64:plc67JdoBykgQPhTJV8BCu1MDAYM0QRbZt93mnh/uyE=
         pterodactyl_panel_hashids_salt: YhQ1W5XhR1cTZGMLK16a
         # DB Settings

roles/pterodactyl_panel/molecule/default/prepare.yml

@@ -4,21 +4,3 @@
       apt:
         update_cache: yes
       when: ansible_os_family == "Debian"
-
-    - name: SSL cert directory exists
-      ansible.builtin.file:
-        path: /etc/letsencrypt/live/{{ ansible_fqdn }}/
-        state: directory
-        owner: root
-        group: root
-        mode: "755"
-    - name: Copy existing SSL cert/key to fake letsencrypt directory
-      copy:
-        src: "{{ item }}"
-        dest: /etc/letsencrypt/live/{{ ansible_fqdn }}/
-        owner: root
-        group: root
-        mode: 0755 # this is insecure, don't do this in prod
-      loop:
-        - "fullchain.pem"
-        - "privkey.pem"

roles/pterodactyl_panel/molecule/default/verify.yml

@@ -0,0 +1,14 @@
+---
+- name: Verify
+  hosts: panel
+  tasks:
+    - name: Get panel homepage
+      ansible.builtin.uri:
+        url: "https://{{ pterodactyl_panel_domain }}"
+        ca_path: "{{ pterodactyl_panel_ssl_cert }}"
+        return_content: true
+      register: page
+    - name: Verify that homepage was loaded
+      assert:
+        that:
+          - '"Pterodactyl" in page.content'

roles/pterodactyl_panel/tasks/selfsign.yml

@@ -5,9 +5,19 @@
     group: www-data
     mode: "640"
 
+- name: Signing request (CSR) for self-signed certificate
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: "{{ pterodactyl_panel_ssl_key }}"
+    common_name: "{{ pterodactyl_panel_domain }}"
+    organization_name: Pterodactyl Panel
+  register: csr
+  changed_when: no
+  check_mode: no
+
 - name: Self-signed cert is present
   community.crypto.x509_certificate:
     path: "{{ pterodactyl_panel_ssl_cert }}"
+    csr_content: "{{ csr.csr }}"
     privatekey_path: "{{ pterodactyl_panel_ssl_key }}"
     provider: selfsigned
     owner: root