ISTI-ansible-roles
/
ansible-roles
4
0
Fork 3
Code Issues Pull Requests Releases Wiki Activity

Merge pull request 'IPA server: Fix the letsencrypt acme hook and the letsencrypt proxy entry for the httpd server.' (#170) from adellam/ansible-roles:master into master

This commit is contained in:
Andrea Dell'Amico 2020-03-31 23:22:47 +02:00
parent 665b1441a5 6043de35f4
commit 118c25542d
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
library/roles/ipa-server/tasks/main.yml
View File

@ -2,6 +2,12 @@
- block: - block:
- name: Install the apache letsencrypt directives on trusty - name: Install the apache letsencrypt directives on trusty
template: src=letsencrypt-proxy.conf.j2 dest=/etc/apache2/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644 template: src=letsencrypt-proxy.conf.j2 dest=/etc/apache2/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
when: ansible_distribution_file_variety == "Debian"
notify: httpd reload
- name: Install the apache letsencrypt directives on CentOS
template: src=letsencrypt-proxy.conf.j2 dest=/etc/httpd/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
when: ansible_distribution_file_variety == "RedHat"
notify: httpd reload notify: httpd reload
- name: Create the acme hooks directory if it does not yet exist - name: Create the acme hooks directory if it does not yet exist

2
library/roles/ipa-server/templates/ipa-letsencrypt-acmetool.sh
View File

@ -18,7 +18,7 @@ krb_realm=$( grep realm /etc/ipa/default.conf | awk '{ print $3 }' )
/bin/cp -f "$LE_CERTS_DIR/fullchain" /etc/pki/ipa/cert.pem /bin/cp -f "$LE_CERTS_DIR/fullchain" /etc/pki/ipa/cert.pem
/bin/cp -f "$LE_CERTS_DIR/privkey" /etc/pki/ipa/cert-key.pem /bin/cp -f "$LE_CERTS_DIR/privkey" /etc/pki/ipa/cert-key.pem
ipa-server-certinstall -w -d /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem --pin='' -p '' ipa-server-certinstall -w -d /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem --pin='' -p '{{ ipa_manager_password }}'
systemctl reload httpd systemctl reload httpd
systemctl restart "dirsrv@${krb_realm//./-}.service" systemctl restart "dirsrv@${krb_realm//./-}.service"