refactor: fix root ca rotation

I'm fucked

roles/pki_cert/tasks/main.yml

@@ -72,31 +72,38 @@
         label: "{{ item.item }}"
       when: item.stat.exists
 
-- name: Create private key for {{ pki_cert_name }}
-  community.crypto.openssl_privatekey:
-    path: "{{ pki_cert_dir }}/cert.key"
-
-- name: Create CSR for {{ pki_cert_name }}
-  community.crypto.openssl_csr_pipe:
-    privatekey_path: "{{ pki_cert_dir }}/cert.key"
-    subject_alt_name: "{{ pki_cert_sans }}"
-  register: pki_cert_csr
-
-- name: Sign with root ca
-  community.crypto.x509_certificate:
-    path: "{{ pki_cert_dir }}/cert.pem"
-    csr_content: "{{ pki_cert_csr.csr }}"
-    provider: ownca
-    ownca_path: /etc/pki/konchin.com/rootca.pem
-    ownca_privatekey_path: /etc/pki/konchin.com/rootca.key
-    ownca_privatekey_passphrase: "{{ secret_ca_passphrase }}"
-    ownca_not_after: +365d  # valid for one year
-    ownca_not_before: -1d   # valid since yesterday
-    return_content: true
-  register: pki_cert_signed
-
-- name: Create full chain
+# community.crypto.x509_certificate recomputes ownca_not_after/not_before
+# relative to "now" on every run, which never exactly matches the fixed
+# timestamps of an already-issued certificate. Left unguarded, that makes it
+# silently reissue (and extend) the certificate on every playbook run,
+# bypassing the archiving above. Only (re)generate when there is no
+# certificate yet, or when we've actually decided it needs rotating.
+- name: Issue certificate
+  when: not pki_cert_existing.stat.exists or pki_cert_needs_rotation
   block:
+    - name: Create private key for {{ pki_cert_name }}
+      community.crypto.openssl_privatekey:
+        path: "{{ pki_cert_dir }}/cert.key"
+
+    - name: Create CSR for {{ pki_cert_name }}
+      community.crypto.openssl_csr_pipe:
+        privatekey_path: "{{ pki_cert_dir }}/cert.key"
+        subject_alt_name: "{{ pki_cert_sans }}"
+      register: pki_cert_csr
+
+    - name: Sign with root ca
+      community.crypto.x509_certificate:
+        path: "{{ pki_cert_dir }}/cert.pem"
+        csr_content: "{{ pki_cert_csr.csr }}"
+        provider: ownca
+        ownca_path: /etc/pki/konchin.com/rootca.pem
+        ownca_privatekey_path: /etc/pki/konchin.com/rootca.key
+        ownca_privatekey_passphrase: "{{ secret_ca_passphrase }}"
+        ownca_not_after: +365d  # valid for one year
+        ownca_not_before: -1d   # valid since yesterday
+        return_content: true
+      register: pki_cert_signed
+
     - name: Slurp root ca
       ansible.builtin.slurp:
         src: /etc/pki/konchin.com/rootca.pem