The certificates role fetched https://authentik.renner.uno with
validate_certs: false and fed whatever it got back into
update-ca-certificates on every Ansible-managed host — an on-path/DNS
attacker during that fetch could plant a rogue CA cluster-wide.
authentik.renner.uno also turned out to be a stale hostname: it isn't
routed by the current Traefik/cert-manager ingress. The live service
(auth.renner.uno) already gets a publicly-trusted Let's Encrypt cert via
cert-manager, which the OS default CA bundle already trusts. Nothing else
in the repo depends on the installed authentik.crt, so removing the task
(and its now-unused handler) closes the hole with no functional loss.
Fixes#185
Co-Authored-By: Claude Bot <claude-bot@renner.uno>
claude-bot
e3e8f57838