Add puri.sm CA

Do this in a separate infra role that sets up things we might
want on all build related machines.

install_jenkins.yml

@@ -16,6 +16,8 @@
         - molly-guard
     jenkins_home: "/var/lib/jenkins"
   roles:
+    - role: infra
+      tags: infra
     - role: geerlingguy.jenkins
       jenkins_package_state: latest # allow upgrades
       # use LTS

roles/infra/files/puri.sm.crt

+-----BEGIN CERTIFICATE-----
+MIIEDjCCAvagAwIBAgIIV18HGw1aQdIwDQYJKoZIhvcNAQELBQAwgZcxIDAeBgNV
+BAMTF1B1cmlzbSBJbnRlcm5hbCBST09UIENBMQswCQYDVQQLEwJJVDEPMA0GA1UE
+ChMGUHVyaXNtMRwwGgYDVQQHExNTb3V0aCBTYW4gRnJhbmNpc2NvMQswCQYDVQQI
+EwJDQTELMAkGA1UEBhMCVVMxHTAbBgkqhkiG9w0BCQEWDmFkbWluc0BwdXJpLnNt
+MCIYDzIwMTYwNjEzMTkxOTI3WhgPMjAzNjA2MDgxOTIwMDBaMIGXMSAwHgYDVQQD
+ExdQdXJpc20gSW50ZXJuYWwgUk9PVCBDQTELMAkGA1UECxMCSVQxDzANBgNVBAoT
+BlB1cmlzbTEcMBoGA1UEBxMTU291dGggU2FuIEZyYW5jaXNjbzELMAkGA1UECBMC
+Q0ExCzAJBgNVBAYTAlVTMR0wGwYJKoZIhvcNAQkBFg5hZG1pbnNAcHVyaS5zbTCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMB1yAIF0Axnr6wMgFO/zaOA
+ds8+FBmZXCS0/LBCjVoDXQSlhcf+49QwbEwmkHbFPqDcp1On6xNgeESzCrJ3DEYZ
+lurSRoKcESyl4qFXOPSOTXRP+UHdEfTC9Z+3mpN9p/jz3S4IaiV1efNj5QkfvWo4
+RYXwY1TACGhBFWak44RJfuXFx2zTx77VWt8aHVX4NXO74+r3Zq/ZCXLKF1+ACZlq
+SeOL8nJWrPi6YEnVgCoH5heIhuQ8ic2vK2ahr1P0ZiEwoyKvqRFumOD3be+KMukL
+pIJ7e9stkI695FQEpFLoz/Yum5dGq8s4BiMz20IMJUFa1wIVB8bohgum132BFr0C
+AwEAAaNYMFYwDwYDVR0TAQH/BAUwAwEB/zATBgNVHSUEDDAKBggrBgEFBQcDCDAP
+BgNVHQ8BAf8EBQMDBwQAMB0GA1UdDgQWBBR6WW9t6kCA6JyeeKaY1xJs1j2vpzAN
+BgkqhkiG9w0BAQsFAAOCAQEAXEUkev97S8TS8pc8AdHLg0FnUI2f63LU0Cbi2kio
+pWoUKpNFrv9x54Z/Oel2yho0eRrxNtk03GFah82UtK6YIe9dLumRTuL2W1DW2KXC
+tn4k417ExlRwHiMBziVfuKEG+MopIa27eUnRI44cNcgd0tLBPcBut0trn+LrB+zZ
+J31Vo0ZDv5Ck6H6+FERSBj/d6ASO7kHWXFHJYgTBOycdh1dCvCN+K/PG1r0OeMnM
+ef29KYdDHoyDJokfxq0x7loJpzOtpT5dcJhEQ+0yLk6BG9fey0En59WWJOdIyrp+
+0XT9vvClIIQpljg2pvkFZ1c2xHHn8L5fCVisn+Cowr+FWw==
+-----END CERTIFICATE-----
+

roles/infra/handlers/main.yml

+- name: Refresh certs
+  command: update-ca-certificates

roles/infra/tasks/main.yml

+- name: Ensure puri.sm CA
+  copy:
+     src: puri.sm.crt
+     dest: /usr/local/share/ca-certificates/puri.sm.crt
+  notify: Refresh certs