diff --git a/tasks/main.yml b/tasks/main.yml index 94b4463..4accbae 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -62,3 +62,36 @@ when: not vsftpd_server_enabled tags: [ 'vsftpd', 'ftp' ] + +- name: Letsencrypt certificates + block: + - name: Create the acme hooks directory if it does not yet exist + ansible.builtin.file: + dest: '{{ letsencrypt_acme_sh_services_scripts_dir }}' + state: directory + owner: root + group: root + + - name: Create a directory where to put the certificate file to control the renewal date + ansible.builtin.file: + dest: /etc/pki/vsftpd + state: directory + owner: root + group: root + + - name: Copy the certificate file + ansible.builtin.copy: + src: '{{ letsencrypt_acme_sh_certificates_install_path }}/cert' + dest: /etc/pki/vsftpd/vsftpd.pem + remote_src: yes + + - name: Install a script that restarts the vsftpd server when a certificate is being renewed + ansible.builtin.template: + src: vsftpd-letsencrypt-acme.sh.j2 + dest: '{{ letsencrypt_acme_sh_services_scripts_dir }}/vsftpd' + owner: root + group: root + mode: 4555 + + when: letsencrypt_acme_sh_install + tags: [ 'vsftpd', 'ftp', 'letsencrypt', 'letsencrypt_acme_sh', 'vsftpd_letsencrypt' ] diff --git a/templates/vsftpd-letsencrypt-acme.sh.j2 b/templates/vsftpd-letsencrypt-acme.sh.j2 new file mode 100644 index 0000000..b7274c9 --- /dev/null +++ b/templates/vsftpd-letsencrypt-acme.sh.j2 @@ -0,0 +1,45 @@ +#!/bin/bash + +H_NAME=$( hostname -f ) +LE_SERVICES_SCRIPT_DIR=/usr/lib/acme/hooks +LE_CERTS_DIR=/var/lib/acme/live/$H_NAME +LE_LOG_DIR=/var/log/letsencrypt +VSFTPD_CERTDIR=/etc/pki/vsftpd +VSFTPD_CERTFILE=$VSFTPD_CERTDIR/vsftpd.pem +DATE=$( date ) +RETVAL= + +[ ! -d $VSFTPD_CERTDIR ] && mkdir -p $VSFTPD_CERTDIR +[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR +echo "$DATE" >> $LE_LOG_DIR/vsftpd.log + +logger "acme-pg-hook: Check if the certificate has been renewed" +cmp ${LE_CERTS_DIR}/cert ${VSFTPD_CERTFILE} +RETVAL=$? +if [ $RETVAL -eq 0 ] ; then + logger "acme-vsftpd-hook: No new cerficate." + echo "acme-vsftpd-hook: No new cerficate." >> $LE_LOG_DIR/vsftpd.log +else + logger "acme-vsftpd-hook: Copying the certificate file" + echo "Copy the key file" >> $LE_LOG_DIR/vsftpd.log + /bin/cp -f ${LE_CERTS_DIR}/cert ${VSFTPD_CERTFILE} +fi + +chmod 644 ${VSFTPD_CERTFILE} +chown root ${VSFTPD_CERTFILE} +chgrp root ${VSFTPD_CERTFILE} + +if [ -x /bin/systemctl ] ; then + logger "acme-vsftpd-hook: Restart the VSFTPD service after a certificate renewal" + systemctl restart VSFTPD >> $LE_LOG_DIR/vsftpd.log 2>&1 + echo "acme-vsftpd-hook: Restart the VSFTPD service" >> $LE_LOG_DIR/vsftpd.log +else + logger "acme-vsftpd-hook: Restart the VSFTPD service after a certificate renewal" + echo "Restart the VSFTPD service" >> $LE_LOG_DIR/vsftpd.log + service vsftpd restart >> $LE_LOG_DIR/vsftpd.log 2>&1 +fi + +logger "acme-vsftpd-hook: Done" +echo "acme-vsftpd-hook: Done." >> $LE_LOG_DIR/vsftpd.log + +exit 0