library/roles/letsencrypt-acmetool-client: Fix the initialization procedure.

library/roles/ubuntu-deb-general/tasks/pki-basics.yml: A link to the fullchain was missing.

letsencrypt-acmetool-client/handlers/main.yml

@@ -2,8 +2,6 @@
 - name: Initialize letsencrypt acmetool
   become: True
   become_user: '{{ letsencrypt_acme_user }}'
-  command: '{{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} quickstart ; {{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} reconcile'
-  args:
-    creates: '{{ letsencrypt_acme_user_home }}/accounts'
+  command: '/usr/local/bin/acme-cert-request > {{ letsencrypt_acme_log_dir }}/acme-cron.log 2>&1'
   when: letsencrypt_acme_install
 

letsencrypt-acmetool-client/tasks/main.yml

@@ -99,27 +99,20 @@
   when: letsencrypt_acme_install
   tags: letsencrypt
 
-- name: Install a daily cron job to renew the certificates when needed
-  cron: name="Letsencrypt certificate renewal" special_time=daily job="{{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} reconcile > {{ letsencrypt_acme_log_dir }}/acme-cron.log 2>&1" user={{ letsencrypt_acme_user }}
+- name: Install a script that requests the certificates and manage the self signed certificate
+  template: src=acme-cert-request.sh.j2 dest=/usr/local/bin/acme-cert-request owner=root group=root mode=0755
   when: letsencrypt_acme_install
   tags: letsencrypt
   
-- name: letsencrypt acmetool initializaztion
-  become: True
-  become_user: '{{ letsencrypt_acme_user }}'
-  shell: 'rm -fr {{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert ; rm -fr {{ letsencrypt_acme_user_home }}/keys/fakeselfsignedcert ; rm {{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }} ; {{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} quickstart'
-  args:
-    creates: '{{ letsencrypt_acme_user_home }}/accounts'
+- name: Install a daily cron job to renew the certificates when needed
+  cron: name="Letsencrypt certificate renewal" special_time=daily job="/usr/local/bin/acme-cert-request > {{ letsencrypt_acme_log_dir }}/acme-cron.log 2>&1" user={{ letsencrypt_acme_user }}
   when: letsencrypt_acme_install
-  ignore_errors: True
   tags: letsencrypt
 
 - name: letsencrypt acmetool request the first certificate
   become: True
   become_user: '{{ letsencrypt_acme_user }}'
-  command: '{{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} reconcile'
-  args:
-    creates: '{{ letsencrypt_acme_certs_dir }}/cert'
+  shell: '/usr/local/bin/acme-cert-request > {{ letsencrypt_acme_log_dir }}/acme-init.log 2>&1'
   when: letsencrypt_acme_install
   ignore_errors: True
   tags: letsencrypt

letsencrypt-acmetool-client/templates/acme-cert-request.sh.j2

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+TMP_DIR=/var/tmp/acmetool
+BASE_DIR=/var/lib/acme
+RETVAL=
+
+if [ -d $BASE_DIR/keys/fakeselfsignedcert -a -d $BASE_DIR/certs/fakeselfsignedcert ] ; then
+    mkdir -p $TMP_DIR/{keys,certs}
+    mv $BASE_DIR/keys/fakeselfsignedcert $TMP_DIR/keys
+    mv $BASE_DIR/certs/fakeselfsignedcert $TMP_DIR/certs
+    /bin/rm live/{{ ansible_fqdn }}
+    {{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} quickstart
+fi
+
+{{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} reconcile
+RETVAL=$?
+
+if [ -d $TMP_DIR ] ; then
+    if [ $RETVAL -ne 0 ] ; then
+        mv $TMP_DIR/keys/fakeselfsignedcert $BASE_DIR/keys
+        mv $TMP_DIR/certs/fakeselfsignedcert $BASE_DIR/certs
+        cd $BASE_DIR/live
+        ln -s ../certs/fakeselfsignedcert {{ ansible_fqdn }}
+    fi
+    rm -fr $TMP_DIR
+fi
+
+exit $RETVAL

ubuntu-deb-general/tasks/pki-basics.yml

@@ -23,6 +23,9 @@
   when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
   tags: [ 'pki', 'ssl', 'letsencrypt' ]
 
+# 20160506121714 [WARN] fdb: "keys/fakeselfsignedcert" has wrong mode -rwxr-xr-x, changing to -rwx------
+# 20160506121714 [WARN] fdb: "keys/fakeselfsignedcert/privkey" has wrong mode -rw-r--r--, changing to -rw-------
+
 - name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the certificate and private key
   command: openssl req -x509 -newkey rsa:2048 -keyout {{ letsencrypt_acme_user_home }}/keys/fakeselfsignedcert/privkey -out {{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/cert -days 10 -nodes -subj '/CN=self signed certificate'
   args:
@@ -40,6 +43,11 @@
   when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
   tags: [ 'pki', 'ssl', 'letsencrypt' ]
   
+- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the fullchain file
+  file: src=cert dest={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/fullchain state=link
+  when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
+  tags: [ 'pki', 'ssl', 'letsencrypt' ]
+  
 - name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the certificate if there is not one
   file: src=../certs/fakeselfsignedcert dest={{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }} state=link
   when: ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )