haproxy: Run the OCSP stapling script after a certificate has been renewed. See https://support.d4science.org/issues/10008

haproxy/tasks/haproxy-letsencrypt-acmetool.yml

@@ -7,7 +7,7 @@
   tags: [ 'haproxy', 'letsencrypt' ]
 
 - name: Install a script that fix the letsencrypt certificate for haproxy and then reload the service
-  copy: src=haproxy-letsencrypt-acme.sh dest={{ letsencrypt_acme_services_scripts_dir }}/haproxy owner=root group=root mode=4555
+  template: src=haproxy-letsencrypt-acme.sh.j2 dest={{ letsencrypt_acme_services_scripts_dir }}/haproxy owner=root group=root mode=4555
   when:
     - haproxy_letsencrypt_managed
     - letsencrypt_acme_install

haproxy/tasks/haproxy-ssl.yml

@@ -8,7 +8,7 @@
 
     - name: Install a cron job that refreshes the OCSP configuration
       cron:
-        name: "Refresh haproxy OCSP information"
+        name: "Refresh the haproxy OCSP information"
         user: root
         special_time: daily
         job: "/usr/local/bin/hapos-upd --cert {{ haproxy_cert_dir }}/haproxy.pem -v {{ letsencrypt_acme_certs_dir }}/fullchain -s {{ haproxy_admin_socket }} >/var/log/hapos-upd.log 2>&1"

haproxy/templates/haproxy-letsencrypt-acme.sh.j2

@@ -30,6 +30,12 @@ else
     service haproxy reload >> $LE_LOG_DIR/haproxy.log 2>&1
 fi
 
+# Run the OCSP stapling script
+if [ -x /usr/local/bin/hapos-upd ] ; then
+    echo "Run the OCSP stapling script" >> $LE_LOG_DIR/haproxy.log
+    /usr/local/bin/hapos-upd --cert {{ haproxy_cert_dir }}/haproxy.pem -v {{ letsencrypt_acme_certs_dir }}/fullchain -s {{ haproxy_admin_socket }} >> $LE_LOG_DIR/haproxy.log 2>&1
+fi
+
 echo "Done." >> $LE_LOG_DIR/haproxy.log
 
 exit 0