ansible/roles/consul_server/handlers/main.yml

@@ -3,16 +3,6 @@
   systemd:
     daemon_reload: True
 
-- name: reload_consul_debian
-  systemd:
-    name: consul
-    state: reloaded
-
-- name: reload_consul_fbsd
-  service:
-    name: consul
-    state: reloaded
-
 - name: restart_consul_debian
   systemd:
     name: consul

ansible/roles/consul_server/tasks/Debian.yml

@@ -47,7 +47,6 @@
     VAULT_FORMAT: json
   register: cert_data
   when: exp.rc != 0
-  notify: reload_consul
 
 - name: write cert data to server
   copy:

ansible/roles/consul_server/tasks/FreeBSD.yml

@@ -47,7 +47,6 @@
     VAULT_FORMAT: json
   register: cert_data
   when: exp.rc != 0
-  notify: reload_consul
 
 - name: write cert data to server
   copy:

ansible/roles/nomad_client/handlers/main.yml

@@ -3,11 +3,6 @@
   systemd:
     daemon_reload: True
 
-- name: reload_nomad
-  systemd:
-    name: nomad
-    state: reloaded
-
 - name: restart_nomad
   systemd:
     name: nomad

ansible/roles/nomad_client/tasks/nomad.yml

@@ -85,55 +85,6 @@
     group: nomad
     remote_src: True
 
-- name: ensure nomad config dir
-  file:
-    path: /etc/nomad.d/certs/
-    state: directory
-    owner: nomad
-    group: nomad
-    mode: 0755
-
-- name: check if server cert is expiring in the next 5 days
-  shell: "openssl x509 -checkend 432000 -noout -in /etc/nomad.d/certs/nomad.pem"
-  args:
-    executable: /bin/bash
-  failed_when: False
-  check_mode: False
-  changed_when: False
-  register: exp
-
-- name: get cert
-  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nomad.service.{{ main_dc_name }}.{{ consul_domain }} alt_names=nomad.service.{{ consul_domain }} ttl=43200m"
-  args:
-    executable: /bin/bash
-  environment:
-    VAULT_ADDR: http://ivyking.minhas.io:8200
-    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
-    VAULT_FORMAT: json
-  register: cert_data
-  when: exp.rc != 0
-  notify: reload_nomad
-
-- name: write cert data to server
-  copy:
-    content: "{{ item.content }}"
-    dest: "/etc/nomad.d/certs/{{ item.path }}"
-    mode: '{{ item.mode }}'
-    owner: nomad
-    group: nomad
-  when: cert_data.changed
-  loop:
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
-        path: "nomad.pem",
-        mode: "0755"
-    }
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
-        path: "nomad.key",
-        mode: "0600"
-    }
-
 - name: ensure nomad is started and enabled
   systemd:
     name: nomad

ansible/roles/nomad_client/templates/nomad.hcl.j2

@@ -9,14 +9,6 @@ consul {
   token     = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-client'] }}"
 }
 
-tls {
-  http      = true
-  rpc       = true
-  ca_file   = "/etc/pki/certs/{{ vault_ca_cert_name }}"
-  cert_file = "/etc/nomad.d/certs/nomad.pem"
-  key_file  = "/etc/nomad.d/certs/nomad.key"
-}
-
 plugin_dir = "/opt/nomad_plugins"
 
 plugin "nomad-driver-podman" {

ansible/roles/nomad_server/handlers/main.yml

@@ -3,11 +3,6 @@
   systemd:
     daemon_reload: True
 
-- name: reload_nomad
-  systemd:
-    name: nomad
-    state: reloaded
-
 - name: restart_nomad
   systemd:
     name: nomad

ansible/roles/nomad_server/tasks/main.yml

@@ -65,55 +65,6 @@
     mode: 0755
   notify: restart_nomad
 
-- name: ensure nomad config dir
-  file:
-    path: /etc/nomad.d/certs/
-    state: directory
-    owner: nomad
-    group: nomad
-    mode: 0755
-
-- name: check if server cert is expiring in the next 5 days
-  shell: "openssl x509 -checkend 432000 -noout -in /etc/nomad.d/certs/nomad.pem"
-  args:
-    executable: /bin/bash
-  failed_when: False
-  check_mode: False
-  changed_when: False
-  register: exp
-
-- name: get cert
-  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nomad.service.{{ main_dc_name }}.{{ consul_domain }} alt_names=nomad.service.{{ consul_domain }} ttl=43200m"
-  args:
-    executable: /bin/bash
-  environment:
-    VAULT_ADDR: http://ivyking.minhas.io:8200
-    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
-    VAULT_FORMAT: json
-  register: cert_data
-  when: exp.rc != 0
-  notify: reload_nomad
-
-- name: write cert data to server
-  copy:
-    content: "{{ item.content }}"
-    dest: "/etc/nomad.d/certs/{{ item.path }}"
-    mode: '{{ item.mode }}'
-    owner: nomad
-    group: nomad
-  when: cert_data.changed
-  loop:
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
-        path: "nomad.pem",
-        mode: "0755"
-    }
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
-        path: "nomad.key",
-        mode: "0600"
-    }
-
 - name: ensure nomad is started and enabled
   systemd:
     name: nomad

ansible/roles/nomad_server/templates/nomad.hcl.j2

@@ -9,11 +9,3 @@ server {
 consul {
   token     = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-server'] }}"
 }
-
-tls {
-  http      = true
-  rpc       = true
-  ca_file   = "/etc/pki/certs/{{ vault_ca_cert_name }}"
-  cert_file = "/etc/nomad.d/certs/nomad.pem"
-  key_file  = "/etc/nomad.d/certs/nomad.key"
-}