Refactor lmn_wlan role

- Consolidate `lmn_wlan`, `lmn_wlan_nm`, and `lmn_wlan_8021x` into single `lmn_wlan` role.
- Implement a check for the availability of the radius-server during the EAP-TLS rollout.
- Enhance variable support with a standardized naming schema:
    - Mode selection via `wlan` variable (`none`, `psk`, `eap-tls`).
    - EAP-TLS CA configuration (CA information, email address, CA password).
    - Introduce a switch to force the (re-)issue of existing certificates.
    - PSK configuration through `wlan_ssid` and `wlan_password`.
- Add a check to verify if the radius certificate is revoked.
- Ensure required packages and services are only installed and configured if the `wifi` variable is set.

roles/lmn_wlan_8021x/tasks/main.yml

@@ -1,94 +0,0 @@
----
-- name: Create private key for client certificate
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/{{ ssid }}.key
-
-- name: Check if a certificate is already issued to client
-  stat:
-    path: "/etc/freeradius/3.0/certs/issued/{{ ansible_hostname }}.crt"
-  register: cert_already_issued
-  delegate_to: radius_server
-
-- name: Revoke already existing client certificate
-  community.crypto.x509_crl:
-    path: "/etc/freeradius/3.0/certs/ca.crl"
-    privatekey_path: "/etc/freeradius/3.0/certs/ca.key"
-    privatekey_passphrase: "{{ radiusca_password }}"
-    crl_mode: "update"
-    issuer:
-      C: "DE"
-      ST: "Baden-Wuerttemberg"
-      L: "Reutlingen"
-      O: "Ferdinand-von-Steinbeis-Schule Reutlingen"
-      emailAddress: "admin@steinbeis.schule"
-      CN: "Radius Certificate Authority"
-    last_update: "+0s"
-    next_update: "+365d"
-    revoked_certificates:
-      - path: "/etc/freeradius/3.0/certs/issued/{{ ansible_hostname }}.crt"
-        revocation_date: 20250311120100Z
-        reason: "unspecified"
-  delegate_to: radius_server
-  when: cert_already_issued.stat.exists
-
-- name: Create CSR for client certificate
-  community.crypto.openssl_csr_pipe:
-    common_name: "{{ ansible_hostname }}"
-    country_name: "{{ country_name }}"
-    state_or_province_name: "{{ state_or_province_name }}"
-    locality_name: "{{ locality_name }}"
-    organization_name: "{{ organization_name }}"
-    privatekey_path: /etc/ssl/private/{{ ssid }}.key
-    email_address: "{{ admin_email }}"
-  register: csr
-
-- name: Sign CSR on Radius
-  community.crypto.x509_certificate_pipe:
-    csr_content: "{{ csr.csr }}"
-    provider: ownca
-    ownca_path: /etc/freeradius/3.0/certs/ca.pem
-    ownca_privatekey_path: /etc/freeradius/3.0/certs/ca.key
-    ownca_privatekey_passphrase: "{{ radiusca_password }}"
-    ownca_not_after: +1825d # 5 Years
-  delegate_to: radius_server
-  register: certificate
-
-- name: Create issued-Notice folder on radius-server
-  ansible.builtin.file:
-    dest: "/etc/freeradius/3.0/certs/issued"
-    state: directory
-    mode: '0755'
-  delegate_to: radius_server
-
-- name: Copy client certificate to radius-server
-  ansible.builtin.copy:
-    dest: "/etc/freeradius/3.0/certs/issued/{{ ansible_hostname }}.crt"
-    mode: "0644"
-    content: "{{ certificate.certificate }}"
-  delegate_to: radius_server
-
-- name: Write certificate to client
-  ansible.builtin.copy:
-    dest: /etc/ssl/certs/{{ ssid }}.crt
-    mode: '0644'
-    content: "{{ certificate.certificate }}"
-
-- name: Check if NetworkManager config exists {{ ssid }}
-  ansible.builtin.stat:
-    path: /etc/NetworkManager/system-connections/{{ ssid }}.nmconnection
-  register: nm_connection
-
-- name: Create or modify connection via nmcli {{ ssid }}
-  ansible.builtin.command: >
-    nmcli c {% if nm_connection.stat.exists %} modify {{ ssid }} {% else %} add {% endif %}
-    type wifi
-    ifname {{ ansible_interfaces | select('search', 'wl.+') | first }}
-    con-name "{{ ssid }}"
-    connection.permissions ""
-    802-11-wireless.ssid "{{ ssid }}"
-    802-11-wireless-security.key-mgmt wpa-eap
-    802-1x.eap tls
-    802-1x.identity {{ ansible_hostname }}
-    802-1x.client-cert /etc/ssl/certs/{{ ssid }}.crt
-    802-1x.private-key /etc/ssl/private/{{ ssid }}.key
-    802-1x.private-key-password dummy