transfer oauth creds as part of certificate bundle

.github/workflows/test.yml

@@ -422,15 +422,15 @@ jobs:
             --initial-admin-password=changeme \
             --tuning development \
             --add-feature foreman-proxy
-      - name: Generate certificates bundle on quadlet
+      - name: Generate auth bundle on quadlet
         run: |
-          ./foremanctl certificate-bundle proxy.example.com \
+          ./foremanctl auth-bundle proxy.example.com \
             ${{ matrix.certificate_source == 'custom_server' && '--certificate-server-certificate /root/custom-certificates/certs/proxy.example.com.crt --certificate-server-key /root/custom-certificates/private/proxy.example.com.key' || '' }}
       - name: Refresh internal CA to ensure it doesn't break the bundle
         if: matrix.certificate_source != 'custom_server'
         run: |
           ./foremanctl deploy --certificate-ca-renew
-      - name: Fetch certificates bundle from quadlet
+      - name: Fetch auth bundle from quadlet
         run: |
           ./forge fetch-bundle proxy.example.com
       - name: Remove old parameters, but keep certificates_source for tests
@@ -440,10 +440,8 @@ jobs:
         run: |
           ./foremanctl deploy-proxy \
             --flavor foreman-proxy-content \
-            --certificate-bundle $(pwd)/.var/lib/foremanctl/proxy.example.com.tar.gz \
+            --auth-bundle $(pwd)/.var/lib/foremanctl/proxy.example.com.tar.gz \
             --foreman-fqdn quadlet.example.com \
-            --oauth-consumer-key $(cat .var/lib/foremanctl/foreman-oauth-consumer-key) \
-            --oauth-consumer-secret $(cat .var/lib/foremanctl/foreman-oauth-consumer-secret) \
             --templates-listen-on http \
             --templates-url http://proxy.example.com:8000
       - name: Run tests

development/playbooks/fetch-bundle/metadata.obsah.yaml

@@ -1,8 +1,8 @@
 ---
 help: |
-  Fetch a certificate bundle
+  Fetch an auth bundle
 
 variables:
   hostname:
     parameter: hostname
-    help: Hostname to fetch the certificate bundle for.
+    help: Hostname to fetch the auth bundle for.

docs/developer/deployment.md

@@ -17,16 +17,19 @@ Deploys a Foreman server. This is the primary deployment type and the default en
 
 Deploys a Foreman Proxy node that connects to a Foreman server.
 
-Before running the proxy deployment, a certificate bundle must be generated on the Foreman server and copied to the proxy VM:
+Before running the proxy deployment, an auth bundle must be generated on the Foreman server and copied to the proxy VM:
 
-1. On the **Foreman server**, generate a certificate bundle for the proxy hostname:
+1. On the **Foreman server**, generate an auth bundle for the proxy hostname:
 
    ```bash
-   ./foremanctl certificate-bundle proxy.example.com
+   ./foremanctl auth-bundle proxy.example.com
    ```
 
    This produces a tar archive at a path like `/var/lib/foremanctl/certs/bundles/<hostname>.tar.gz`.
 
+> [!NOTE]
+> The bundle includes the proxy's certificates and OAuth credentials needed for the proxy to communicate with the Foreman server.
+
 2. Copy the bundle to the **proxy VM**:
 
    ```bash
@@ -38,7 +41,7 @@ Before running the proxy deployment, a certificate bundle must be generated on t
    ```bash
    ./foremanctl deploy-proxy \
      --flavor foreman-proxy-content \
-     --certificate-bundle /root/proxy.example.com.tar.gz \
+     --auth-bundle /root/proxy.example.com.tar.gz \
      --foreman-fqdn quadlet.example.com
    ```
 

docs/user/certificates.md

@@ -84,7 +84,7 @@ After deployment, certificates are available at:
 - Certificates from `foreman-installer` are normalized into the same paths as the Default Source above
 - Original directory is backed up to `/root/ssl-build.bak/`
 
-**Proxy/Secondary System Certificates (from certificate-bundle):**
+**Proxy/Secondary System Certificates (from auth-bundle):**
 - Generated in per-host subdirectories: `/var/lib/foremanctl/certs/hosts/<hostname>/`
 - Packaged tarball: `/var/lib/foremanctl/certs/bundles/<hostname>.tar.gz`
 
@@ -138,20 +138,20 @@ foremanctl deploy --certificate-ca-renew
 
 Both flags are **not persisted** in foremanctl’s answers file (one-shot).
 
-### Certificate Bundle for Secondary Systems
+### Auth Bundle for Secondary Systems
 
-The `certificate-bundle` command generates a certificate tarball for a secondary system such as a foreman-proxy host. This is the foremanctl equivalent of `foreman-proxy-certs-generate`.
+The `auth-bundle` command generates a certificate and OAuth credential tarball for a secondary system such as a foreman-proxy host. This is the foremanctl equivalent of `foreman-proxy-certs-generate`.
 
 The internal CA must already exist from a prior `foremanctl deploy`.
 
 #### Usage
 
 ```bash
-# Generate a certificate bundle using the internal CA
-foremanctl certificate-bundle proxy.example.com
+# Generate an auth bundle using the internal CA
+foremanctl auth-bundle proxy.example.com
 
-# Generate a certificate bundle with custom server certificates for the proxy
-foremanctl certificate-bundle \
+# Generate an auth bundle with custom server certificates for the proxy
+foremanctl auth-bundle \
   --certificate-server-certificate /path/to/proxy.example.com.crt \
   --certificate-server-key /path/to/proxy.example.com.key \
   proxy.example.com
@@ -165,7 +165,7 @@ If the Foreman server was deployed with custom server certificates, each proxy m
 
 #### Tarball Contents
 
-The tarball uses the same directory structure as `/var/lib/foremanctl/certs/`:
+The tarball mirrors the on-disk layout under `/var/lib/foremanctl/`:
 
 ```
 certs/
@@ -176,8 +176,13 @@ certs/
 private/
 ├── <hostname>.key              # Server private key
 └── <hostname>-client.key       # Client private key
+oauth/
+├── foreman-oauth-consumer-key      # OAuth consumer key for Foreman API auth
+└── foreman-oauth-consumer-secret   # OAuth consumer secret for Foreman API auth
 ```
 
+On extract, `certs/` and `private/` are installed under `/var/lib/foremanctl/certs/`, and `oauth/` is installed under `/var/lib/foremanctl/oauth/`.
+
 When using the internal CA only, `server-ca.crt` and `ca.crt` are identical. When custom server certificates are provided, `server-ca.crt` contains the custom CA and `ca.crt` contains the internal CA.
 
 ### Current Limitations
@@ -203,7 +208,7 @@ src/roles/certificates/
 │   └── custom.yml             # Applies user-provided custom server certs
 └── defaults/main.yml          # Default configuration variables
 
-src/roles/certificate_bundle/
+src/roles/auth_bundle/
 ├── tasks/main.yml             # Packages certificates into a tarball
 └── defaults/main.yml          # Output directory configuration
 ```
@@ -230,11 +235,11 @@ For `certificate_source: custom_server`:
 2. **Custom Server Certificates**: Copy the custom server cert, key, and CA bundle from user-provided paths to `/var/lib/foremanctl/certs/` (only when certificate paths are provided)
 3. **Host Certificate Issuance**: Generate client certificate and localhost certificate signed by the internal CA (server cert for FQDN is skipped)
 
-#### Certificate Bundle Generation
+#### Auth Bundle Generation
 
-The `certificate-bundle` playbook reuses the `certificates` role to generate proxy certificates in a per-host subdirectory (`certificates_ca_directory/hosts/<hostname>/`). It overrides `certificates_ca_directory_certs`, `certificates_ca_directory_keys`, and `certificates_ca_directory_requests` to point to the subdirectory while keeping `certificates_ca_directory` unchanged so the CA can still be found for signing. It sets `certificates_ca: false` (the CA already exists from a prior deploy) and passes the proxy hostname via `certificates_hostnames`. The `certificate_bundle` role then packages the generated certificates along with the CA into a tarball under `certificates_ca_directory/bundles/`.
+The `auth-bundle` playbook reuses the `certificates` role to generate proxy certificates in a per-host subdirectory (`certificates_ca_directory/hosts/<hostname>/`). It overrides `certificates_ca_directory_certs`, `certificates_ca_directory_keys`, and `certificates_ca_directory_requests` to point to the subdirectory while keeping `certificates_ca_directory` unchanged so the CA can still be found for signing. It sets `certificates_ca: false` (the CA already exists from a prior deploy) and passes the proxy hostname via `certificates_hostnames`. The `auth_bundle` role then packages the generated certificates along with the CA into a tarball under `certificates_ca_directory/bundles/`.
 
-When custom server certificates are provided for the proxy, `certificates_source` is set to `custom_server` so only client certificates are generated by the internal CA. The custom server certificate, key, and CA are validated by the `certificate_checks` role and then packaged directly into the tarball by the `certificate_bundle` role.
+When custom server certificates are provided for the proxy, `certificates_source` is set to `custom_server` so only client certificates are generated by the internal CA. The custom server certificate, key, and CA are validated by the `certificate_checks` role and then packaged directly into the tarball by the `auth_bundle` role.
 
 #### Migration from foreman-installer
 

docs/user/parameters.md

@@ -132,15 +132,20 @@ There are multiple use cases from the users perspective that dictate what parame
 | `--templates-listen-on` | Templates proxy to listen on https, http, or both | `--foreman-proxy-templates-listen-on` |
 | `--templates-url` | URL that hosts will use to contact the proxy for provisioning templates | `--foreman-proxy-templates-url` |
 
+### Unmapped
+
+| foreman-installer Parameter | Description | Reason |
+| --------------------------- | ----------- | ------ |
+| `--foreman-proxy-oauth-consumer-key` | OAuth consumer key for Smart Proxy | Not required(Managed automatically via auth bundle) |
+| `--foreman-proxy-oauth-consumer-secret` | OAuth consumer secret for Smart Proxy | Not required(Managed automatically via auth bundle) |
+
 ### Undetermined
 
 | Installer Parameter | Description | Module | Puppet Parameter |
 | ------------------- | ----------- | ------ | ---------------- |
 | `--foreman-proxy-cname` | Enables DHCP feature in smart-proxy | foreman_proxy | cname |
 | `--foreman-proxy-fqdn` | Enables DHCP feature in smart-proxy | foreman_proxy | fqdn |
 | `--foreman-proxy-foreman-base-url` | | foreman_proxy | foreman_base_url |
-| `--foreman-proxy-oauth-consumer-key` | | foreman_proxy | oauth_consumer_key |
-| `--foreman-proxy-oauth-consumer-secret` | | foreman_proxy | oauth_consumer_secret |
 | `--foreman-proxy-register-in-foreman` | | foreman_proxy | register_in_foreman |
 | `--foreman-proxy-trusted-hosts` | | foreman_proxy | trusted_hosts |
 | `--foreman-proxy-dhcp` | Enables DHCP feature in smart-proxy | foreman_proxy | dhcp |

src/playbooks/auth-bundle/auth-bundle.yaml

@@ -0,0 +1,34 @@
+---
+- name: Generate an auth bundle for a hostname
+  hosts:
+    - quadlet
+  become: true
+  vars_files:
+    - "../../vars/base.yaml"
+    - "../../vars/certificates.yml"
+    - "../../vars/foreman.yml"
+  roles:
+    - role: certificate_checks
+      when: certificates_source == 'custom_server'
+      vars:
+        certificate_checks_certificate: "{{ certificates_custom_server_certificate }}"
+        certificate_checks_key: "{{ certificates_custom_server_key }}"
+        certificate_checks_ca: "{{ server_ca_certificate }}"
+    - role: certificates
+      vars:
+        certificates_ca: false
+        certificates_output_directory: "{{ certificates_ca_directory }}/hosts/{{ hostname }}"
+        certificates_hostnames:
+          - "{{ hostname }}"
+    - role: auth_bundle
+      vars:
+        auth_bundle_hostname: "{{ hostname }}"
+        auth_bundle_ca_bundle: "{{ ca_bundle }}"
+        auth_bundle_ca_certificate: "{{ ca_certificate }}"
+        auth_bundle_server_ca_certificate: "{{ server_ca_certificate }}"
+        auth_bundle_server_certificate: "{{ certificates_ca_directory }}/hosts/{{ hostname }}/certs/{{ hostname }}.crt"
+        auth_bundle_server_key: "{{ certificates_ca_directory }}/hosts/{{ hostname }}/private/{{ hostname }}.key"
+        auth_bundle_client_certificate: "{{ certificates_ca_directory }}/hosts/{{ hostname }}/certs/{{ hostname }}-client.crt"
+        auth_bundle_client_key: "{{ certificates_ca_directory }}/hosts/{{ hostname }}/private/{{ hostname }}-client.key"
+        auth_bundle_oauth_consumer_key_file: "{{ foreman_oauth_consumer_key_file }}"
+        auth_bundle_oauth_consumer_secret_file: "{{ foreman_oauth_consumer_secret_file }}"

src/playbooks/certificate-bundle/metadata.obsah.yaml → src/playbooks/auth-bundle/metadata.obsah.yaml

@@ -1,11 +1,11 @@
 ---
 help: |
-  Generate a certificate bundle
+  Generate an auth bundle
 
 variables:
   hostname:
     parameter: hostname
-    help: Hostname to generate a certificate bundle for that will be the common name.
+    help: Hostname to generate an auth bundle for that will be the common name.
   certificates_custom_server_certificate:
     help: Path to a custom server certificate for the proxy.
     type: AbsolutePath

src/playbooks/deploy-proxy/deploy-proxy.yaml

@@ -25,6 +25,7 @@
         certificate_checks_certificate: "{{ server_certificate }}"
         certificate_checks_key: "{{ server_key }}"
         certificate_checks_ca: "{{ server_ca_certificate }}"
+    - role: oauth_from_bundle
     - role: postgresql
       when:
         - database_mode == 'internal'

src/playbooks/deploy-proxy/metadata.obsah.yaml

@@ -7,20 +7,14 @@ variables:
     help: Base flavor to use in this deployment.
     choices:
       - foreman-proxy-content
-  certificates_bundle:
-    help: Path to the certificate bundle tar file.
+  auth_bundle:
+    help: Path to the auth bundle tar file.
     type: AbsolutePath
-    parameter: --certificate-bundle
+    parameter: --auth-bundle
     persist: false
   foreman_name:
     parameter: --foreman-fqdn
     help: FQDN of the Foreman server this proxy connects to.
-  foreman_proxy_oauth_consumer_key:
-    parameter: --oauth-consumer-key
-    help: OAuth key to be used for communication with Foreman.
-  foreman_proxy_oauth_consumer_secret:
-    parameter: --oauth-consumer-secret
-    help: OAuth secret to be used for communication with Foreman.
 
 include:
   - _flavor_features

src/roles/auth_bundle/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+auth_bundle_output_directory: "{{ certificates_ca_directory }}/bundles"
+auth_bundle_server_ca_certificate: "{{ auth_bundle_ca_certificate }}"