Letsencrypt handler.

This commit is contained in:
Andrea Dell'Amico 2022-01-24 13:25:06 +01:00
parent 03fe415422
commit ec62d48bbb
Signed by: adellam
GPG Key ID: 147ABE6CEB9E20FF
2 changed files with 78 additions and 0 deletions

View File

@ -62,3 +62,36 @@
when: not vsftpd_server_enabled when: not vsftpd_server_enabled
tags: [ 'vsftpd', 'ftp' ] tags: [ 'vsftpd', 'ftp' ]
- name: Letsencrypt certificates
block:
- name: Create the acme hooks directory if it does not yet exist
ansible.builtin.file:
dest: '{{ letsencrypt_acme_sh_services_scripts_dir }}'
state: directory
owner: root
group: root
- name: Create a directory where to put the certificate file to control the renewal date
ansible.builtin.file:
dest: /etc/pki/vsftpd
state: directory
owner: root
group: root
- name: Copy the certificate file
ansible.builtin.copy:
src: '{{ letsencrypt_acme_sh_certificates_install_path }}/cert'
dest: /etc/pki/vsftpd/vsftpd.pem
remote_src: yes
- name: Install a script that restarts the vsftpd server when a certificate is being renewed
ansible.builtin.template:
src: vsftpd-letsencrypt-acme.sh.j2
dest: '{{ letsencrypt_acme_sh_services_scripts_dir }}/vsftpd'
owner: root
group: root
mode: 4555
when: letsencrypt_acme_sh_install
tags: [ 'vsftpd', 'ftp', 'letsencrypt', 'letsencrypt_acme_sh', 'vsftpd_letsencrypt' ]

View File

@ -0,0 +1,45 @@
#!/bin/bash
H_NAME=$( hostname -f )
LE_SERVICES_SCRIPT_DIR=/usr/lib/acme/hooks
LE_CERTS_DIR=/var/lib/acme/live/$H_NAME
LE_LOG_DIR=/var/log/letsencrypt
VSFTPD_CERTDIR=/etc/pki/vsftpd
VSFTPD_CERTFILE=$VSFTPD_CERTDIR/vsftpd.pem
DATE=$( date )
RETVAL=
[ ! -d $VSFTPD_CERTDIR ] && mkdir -p $VSFTPD_CERTDIR
[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
echo "$DATE" >> $LE_LOG_DIR/vsftpd.log
logger "acme-pg-hook: Check if the certificate has been renewed"
cmp ${LE_CERTS_DIR}/cert ${VSFTPD_CERTFILE}
RETVAL=$?
if [ $RETVAL -eq 0 ] ; then
logger "acme-vsftpd-hook: No new cerficate."
echo "acme-vsftpd-hook: No new cerficate." >> $LE_LOG_DIR/vsftpd.log
else
logger "acme-vsftpd-hook: Copying the certificate file"
echo "Copy the key file" >> $LE_LOG_DIR/vsftpd.log
/bin/cp -f ${LE_CERTS_DIR}/cert ${VSFTPD_CERTFILE}
fi
chmod 644 ${VSFTPD_CERTFILE}
chown root ${VSFTPD_CERTFILE}
chgrp root ${VSFTPD_CERTFILE}
if [ -x /bin/systemctl ] ; then
logger "acme-vsftpd-hook: Restart the VSFTPD service after a certificate renewal"
systemctl restart VSFTPD >> $LE_LOG_DIR/vsftpd.log 2>&1
echo "acme-vsftpd-hook: Restart the VSFTPD service" >> $LE_LOG_DIR/vsftpd.log
else
logger "acme-vsftpd-hook: Restart the VSFTPD service after a certificate renewal"
echo "Restart the VSFTPD service" >> $LE_LOG_DIR/vsftpd.log
service vsftpd restart >> $LE_LOG_DIR/vsftpd.log 2>&1
fi
logger "acme-vsftpd-hook: Done"
echo "acme-vsftpd-hook: Done." >> $LE_LOG_DIR/vsftpd.log
exit 0