Letsencrypt handler.

tasks/main.yml

@@ -62,3 +62,36 @@
     when: not vsftpd_server_enabled
 
   tags: [ 'vsftpd', 'ftp' ] 
+
+- name: Letsencrypt certificates
+  block:
+  - name: Create the acme hooks directory if it does not yet exist
+    ansible.builtin.file:
+      dest: '{{ letsencrypt_acme_sh_services_scripts_dir }}'
+      state: directory
+      owner: root
+      group: root
+
+  - name: Create a directory where to put the certificate file to control the renewal date
+    ansible.builtin.file:
+      dest: /etc/pki/vsftpd
+      state: directory
+      owner: root
+      group: root
+
+  - name: Copy the certificate file
+    ansible.builtin.copy:
+      src: '{{ letsencrypt_acme_sh_certificates_install_path }}/cert'
+      dest: /etc/pki/vsftpd/vsftpd.pem
+      remote_src: yes
+
+  - name: Install a script that restarts the vsftpd server when a certificate is being renewed
+    ansible.builtin.template:
+      src: vsftpd-letsencrypt-acme.sh.j2
+      dest: '{{ letsencrypt_acme_sh_services_scripts_dir }}/vsftpd'
+      owner: root
+      group: root
+      mode: 4555
+
+  when: letsencrypt_acme_sh_install
+  tags: [ 'vsftpd', 'ftp', 'letsencrypt', 'letsencrypt_acme_sh', 'vsftpd_letsencrypt' ]

templates/vsftpd-letsencrypt-acme.sh.j2

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+H_NAME=$( hostname -f )
+LE_SERVICES_SCRIPT_DIR=/usr/lib/acme/hooks
+LE_CERTS_DIR=/var/lib/acme/live/$H_NAME
+LE_LOG_DIR=/var/log/letsencrypt
+VSFTPD_CERTDIR=/etc/pki/vsftpd
+VSFTPD_CERTFILE=$VSFTPD_CERTDIR/vsftpd.pem
+DATE=$( date )
+RETVAL=
+
+[ ! -d $VSFTPD_CERTDIR ] && mkdir -p $VSFTPD_CERTDIR
+[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
+echo "$DATE" >> $LE_LOG_DIR/vsftpd.log
+
+logger "acme-pg-hook: Check if the certificate has been renewed"
+cmp ${LE_CERTS_DIR}/cert  ${VSFTPD_CERTFILE}
+RETVAL=$?
+if [ $RETVAL -eq 0 ] ; then
+    logger "acme-vsftpd-hook: No new cerficate."
+    echo "acme-vsftpd-hook: No new cerficate." >> $LE_LOG_DIR/vsftpd.log
+else
+    logger "acme-vsftpd-hook: Copying the certificate file"
+    echo "Copy the key file" >> $LE_LOG_DIR/vsftpd.log
+    /bin/cp -f ${LE_CERTS_DIR}/cert  ${VSFTPD_CERTFILE}
+fi
+
+chmod 644 ${VSFTPD_CERTFILE}
+chown root ${VSFTPD_CERTFILE}
+chgrp root ${VSFTPD_CERTFILE}
+
+if [ -x /bin/systemctl ] ; then
+    logger "acme-vsftpd-hook: Restart the VSFTPD service after a certificate renewal"
+    systemctl restart VSFTPD >> $LE_LOG_DIR/vsftpd.log 2>&1
+    echo "acme-vsftpd-hook: Restart the VSFTPD service" >> $LE_LOG_DIR/vsftpd.log
+else
+    logger "acme-vsftpd-hook: Restart the VSFTPD service after a certificate renewal"
+    echo "Restart the VSFTPD service" >> $LE_LOG_DIR/vsftpd.log
+    service vsftpd restart >> $LE_LOG_DIR/vsftpd.log 2>&1
+fi
+
+logger "acme-vsftpd-hook: Done"
+echo "acme-vsftpd-hook: Done." >> $LE_LOG_DIR/vsftpd.log
+
+exit 0