refactor: fix root ca rotation

I'm fucked

roles/create_rootca/tasks/main.yml

@@ -15,6 +15,20 @@
     owner: root
     group: root
 
+- name: Check for existing root ca certificate
+  ansible.builtin.stat:
+    path: /etc/pki/konchin.com/rootca.pem
+  register: create_rootca_existing
+
+# The x509_certificate/openssl_privatekey modules recompute their relative
+# validity/date options on every run, which never exactly matches the fixed
+# timestamps baked into an already-issued certificate. Left unguarded, that
+# makes them "regenerate" the CA (and invalidate every certificate it
+# signed) on every playbook run. The CA is not meant to auto-rotate, so we
+# only ever create it once.
+- name: Create root ca
+  when: not create_rootca_existing.stat.exists
+  block:
     - name: Create private key for root ca
       community.crypto.openssl_privatekey:
         path: /etc/pki/konchin.com/rootca.key

roles/pki_cert/tasks/main.yml

@@ -72,6 +72,15 @@
         label: "{{ item.item }}"
       when: item.stat.exists
 
+# community.crypto.x509_certificate recomputes ownca_not_after/not_before
+# relative to "now" on every run, which never exactly matches the fixed
+# timestamps of an already-issued certificate. Left unguarded, that makes it
+# silently reissue (and extend) the certificate on every playbook run,
+# bypassing the archiving above. Only (re)generate when there is no
+# certificate yet, or when we've actually decided it needs rotating.
+- name: Issue certificate
+  when: not pki_cert_existing.stat.exists or pki_cert_needs_rotation
+  block:
     - name: Create private key for {{ pki_cert_name }}
       community.crypto.openssl_privatekey:
         path: "{{ pki_cert_dir }}/cert.key"
@@ -95,8 +104,6 @@
         return_content: true
       register: pki_cert_signed
 
-- name: Create full chain
-  block:
     - name: Slurp root ca
       ansible.builtin.slurp:
         src: /etc/pki/konchin.com/rootca.pem