Support java keystore for configuration of sensitive options

[hwo-wd]

New parameters allow to set sensitive options using a Java KeyStore file:

Variable	Description	Default
keycloak_quarkus_key_store_file	Deprecated, use keycloak_quarkus_https_key_store_file instead.
keycloak_quarkus_key_store_password	Password for the key store	""
keycloak_quarkus_https_trust_store_enabled	Enable configuration of a trust store	False
keycloak_quarkus_trust_store_file	The file pat to the trust store	{{ keycloak.home }}/conf/trust_store.p12
keycloak_quarkus_trust_store_password	Password for the trust store	""
keycloak_quarkus_proxy_headers	Parse reverse proxy headers (forwarded or xforwardedPassword)	""
keycloak_quarkus_https_trust_store_password	Password for the trust store	""
keycloak_quarkus_proxy_headers	Parse reverse proxy headers (forwarded or xforwarded)	""
keycloak_quarkus_config_key_store_file	Path to the configuration key store; only used if keycloak_quarkus_keystore_password is not empty	{{ keycloak.home }}/conf/conf_store.p12 if keycloak_quarkus_keystore_password != '', else ''
keycloak_quarkus_config_key_store_password	Password of the configuration key store; if non-empty, keycloak_quarkus_db_pass will be saved to the key store at keycloak_quarkus_config_key_store_file (instead of being written to the configuration file in clear text	""

For additional details, refer to: https://www.keycloak.org/server/configuration#_setting_sensitive_options_using_a_java_keystore_file

Fix #188

=== original PR notes

keytool might not be the best tool for this, but I didn't find any better: openssl does support PKCS12 stores, but does not allow for creating PBEs (password-based entries);

Note that this has a breaking change since variables had to be renamed to reduce confusion.

Open for any improvements, but I didn't find a more ansiblish way to do it since keytool doesn't allow for reading the actual secret values, only whether it exists or not.

Moreover let me know if you see more variables from keycloak.conf that would fit into this key store, thanks.

[guidograzioli]

I am thinking writing a general keytool module for the middleware common collection, but for the time being this is cool.
But, I'd keep the two "old" renamed vars, setting them to the new parameters value. We can mark them deprecated and remove in the next release, without breaking (so basically, temporarily, keycloak_quarkus_key_store_file default to keycloak_quarkus_https_key_store_file), wdyt?

[guidograzioli]

This block happen quite late in the deployment; would you mind moving it to the prereq tasks, so that we fail fast? change_when below can safely be set to false

[hwo-wd]

The check now happens after having installed JVM in fastpackages.yml, so keytool should definitely be there, but a check never hurts either ;)

[hwo-wd]

I am thinking writing a general keytool module for the middleware common collection, but for the time being this is cool. But, I'd keep the two "old" renamed vars, setting them to the new parameters value. We can mark them deprecated and remove in the next release, without breaking (so basically, temporarily, keycloak_quarkus_key_store_file default to keycloak_quarkus_https_key_store_file), wdyt?

I've added this, probably a bit too compliced but it might serve as a base for other roles.

[guidograzioli]

I am thinking writing a general keytool module for the middleware common collection, but for the time being this is cool. But, I'd keep the two "old" renamed vars, setting them to the new parameters value. We can mark them deprecated and remove in the next release, without breaking (so basically, temporarily, keycloak_quarkus_key_store_file default to keycloak_quarkus_https_key_store_file), wdyt?

I've added this, probably a bit too compliced but it might serve as a base for other roles.

Brilliant, I was just implying a line or two in the docs to mention the deprecation, but this is perfect

[guidograzioli]

new linter rules on ahub driving me crazy, please rebase on main (again); sorry bout that

[hwo-wd]

new linter rules on ahub driving me crazy, please rebase on main (again); sorry bout that

no worries -> done.

[guidograzioli]

OK; i'll release .2 as final 2.1 (with all the linter ****); then I'll merge and we can eventually start 2.2
Thanks for your contribution!

[guidograzioli]

LGTM