forked from ISTI-ansible-roles/ansible-roles
Cleanup the basic pki tasks. Add support for acme.sh
This commit is contained in:
Andrea Dell'Amico
parent
708f8027ef
commit
a5f0c611b7
|
|
@ -20,6 +20,10 @@
|
|||
- import_tasks: rsyslogfix.yml
|
||||
- import_tasks: unattended-upgrades.yml
|
||||
- import_tasks: pki-basics.yml
|
||||
- import_tasks: pki-basics-letsencrypt-acmetool.yml
|
||||
when: letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||||
- import_tasks: pki-basics-letsencrypt-acme-sh.yml
|
||||
when: letsencrypt_acme_sh_install is defined and letsencrypt_acme_sh_install
|
||||
- import_tasks: install_external_ca_cert.yml
|
||||
- import_tasks: manage_su_limits.yml
|
||||
- import_tasks: disable-unneeded-services.yml
|
||||
|
|
|
|||
|
|
@ -0,0 +1,43 @@
|
|||
- block:
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Check if a certificate already exists. If so, skip all the related tasks
|
||||
stat: path={{ letsencrypt_acme_sh_user_home }}/live/{{ ansible_fqdn }}
|
||||
register: true_cert
|
||||
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
when: letsencrypt_acme_sh_install is defined and letsencrypt_acme_sh_install
|
||||
|
||||
- block:
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Now the physical paths
|
||||
file: path={{ item }} mode=0755 state=directory
|
||||
with_items:
|
||||
- '{{ letsencrypt_acme_sh_user_home }}/live'
|
||||
- '{{ letsencrypt_acme_sh_user_home }}/certs/fakeselfsignedcert'
|
||||
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Now the physical path for the key file
|
||||
file: path={{ item }} mode=0700 state=directory
|
||||
with_items:
|
||||
- '{{ letsencrypt_acme_sh_user_home }}/keys/fakeselfsignedcert'
|
||||
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Now the certificate and private key
|
||||
command: openssl req -x509 -newkey rsa:2048 -keyout {{ letsencrypt_acme_sh_user_home }}/keys/fakeselfsignedcert/privkey -out {{ letsencrypt_acme_sh_user_home }}/certs/fakeselfsignedcert/cert -days 365 -nodes -subj '/CN={{ ansible_fqdn }} self signed'
|
||||
args:
|
||||
creates: '{{ letsencrypt_acme_sh_user_home }}/certs/fakeselfsignedcert/cert'
|
||||
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Now the symbolic links for the private key
|
||||
file: src=../../keys/fakeselfsignedcert/privkey dest={{ letsencrypt_acme_sh_user_home }}/certs/fakeselfsignedcert/privkey state=link
|
||||
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Now the symbolic links for the chain file
|
||||
file: src=cert dest={{ letsencrypt_acme_sh_user_home }}/certs/fakeselfsignedcert/chain state=link
|
||||
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Now the symbolic links for the fullchain file
|
||||
file: src=cert dest={{ letsencrypt_acme_sh_user_home }}/certs/fakeselfsignedcert/fullchain state=link
|
||||
|
||||
- name: When we are going to install letsencrypt acme.sh certificates, create a preliminary path and a self signed cert. Now the symbolic links for the certificate if there is not one
|
||||
file: src=../certs/fakeselfsignedcert dest={{ letsencrypt_acme_sh_user_home }}/live/{{ ansible_fqdn }} state=link
|
||||
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
when:
|
||||
- letsencrypt_acme_sh_install is defined and letsencrypt_acme_sh_install
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- true_cert.stat.islnk is not defined
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
---
|
||||
- block:
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Check if a certificate already exists. If so, skip all the related tasks
|
||||
stat: path={{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }}
|
||||
register: true_cert
|
||||
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
when: letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||||
|
||||
- block:
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Now the physical paths
|
||||
file: path={{ item }} mode=0755 state=directory
|
||||
with_items:
|
||||
- '{{ letsencrypt_acme_user_home }}/live'
|
||||
- '{{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert'
|
||||
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Now the physical path for the key file
|
||||
file: path={{ item }} mode=0700 state=directory
|
||||
with_items:
|
||||
- '{{ letsencrypt_acme_user_home }}/keys/fakeselfsignedcert'
|
||||
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Now the certificate and private key
|
||||
command: openssl req -x509 -newkey rsa:2048 -keyout {{ letsencrypt_acme_user_home }}/keys/fakeselfsignedcert/privkey -out {{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/cert -days 365 -nodes -subj '/CN={{ ansible_fqdn }} self signed'
|
||||
args:
|
||||
creates: '{{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/cert'
|
||||
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Now the symbolic links for the private key
|
||||
file: src=../../keys/fakeselfsignedcert/privkey dest={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/privkey state=link
|
||||
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Now the symbolic links for the chain file
|
||||
file: src=cert dest={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/chain state=link
|
||||
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Now the symbolic links for the fullchain file
|
||||
file: src=cert dest={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/fullchain state=link
|
||||
|
||||
- name: When we are going to install letsencrypt acmetool certificates, create a preliminary path and a self signed cert. Now the symbolic links for the certificate if there is not one
|
||||
file: src=../certs/fakeselfsignedcert dest={{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }} state=link
|
||||
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
when:
|
||||
- letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- true_cert.stat.islnk is not defined
|
||||
|
|
@ -1,90 +1,11 @@
|
|||
---
|
||||
- name: Ensure that the PKI directory exists
|
||||
file: path={{ pki_dir }} state=directory owner=root group=root mode=0755
|
||||
- block:
|
||||
- name: Ensure that the PKI directory exists
|
||||
file: path={{ pki_dir }} state=directory owner=root group=root mode=0755
|
||||
|
||||
- name: Ensure that the PKI subdirectories exist
|
||||
file: path={{ pki_dir }}/{{ item }} state=directory owner=root group=root mode=0755
|
||||
with_items: '{{ pki_subdirs }}'
|
||||
|
||||
tags: [ 'pki', 'ssl', 'ca', 'letsencrypt' ]
|
||||
|
||||
- name: Ensure that the PKI subdirectories exist
|
||||
file: path={{ pki_dir }}/{{ item }} state=directory owner=root group=root mode=0755
|
||||
with_items: '{{ pki_subdirs }}'
|
||||
tags: [ 'pki', 'ssl', 'ca', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Check if a certificate already exists. If so, skip all the related tasks
|
||||
stat: path={{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }}
|
||||
register: true_cert
|
||||
when: ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the physical paths
|
||||
file: path={{ item }} mode=0755 state=directory
|
||||
with_items:
|
||||
- '{{ letsencrypt_acme_user_home | default(omit) }}/live'
|
||||
- '{{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert'
|
||||
when:
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
- letsencrypt_acme_user_home | default(omit) is defined
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the physical paths
|
||||
file: path={{ item }} mode=0700 state=directory
|
||||
with_items:
|
||||
- '{{ letsencrypt_acme_user_home | default(omit) }}/keys/fakeselfsignedcert'
|
||||
when:
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
- letsencrypt_acme_user_home | default(omit) is defined
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the certificate and private key
|
||||
command: openssl req -x509 -newkey rsa:2048 -keyout {{ letsencrypt_acme_user_home | default(omit) }}/keys/fakeselfsignedcert/privkey -out {{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/cert -days 365 -nodes -subj '/CN={{ ansible_fqdn }} self signed'
|
||||
args:
|
||||
creates: '{{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/cert'
|
||||
when:
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the private key
|
||||
file: src=../../keys/fakeselfsignedcert/privkey dest={{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/privkey state=link
|
||||
when:
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the chain file
|
||||
file: src=cert dest={{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/chain state=link
|
||||
when:
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the fullchain file
|
||||
file: src=cert dest={{ letsencrypt_acme_user_home | default(omit) }}/certs/fakeselfsignedcert/fullchain state=link
|
||||
when:
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the certificate if there is not one
|
||||
file: src=../certs/fakeselfsignedcert dest={{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }} state=link
|
||||
when:
|
||||
- true_cert is defined
|
||||
- true_cert.stat is defined
|
||||
- ( true_cert.stat.islnk is not defined ) and ( letsencrypt_acme_install is defined and letsencrypt_acme_install )
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now handle the haproxy special case
|
||||
shell: mkdir {{ pki_dir }}/haproxy ; cat {{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }}/privkey {{ letsencrypt_acme_user_home | default(omit) }}/live/{{ ansible_fqdn }}/cert > {{ pki_dir }}/haproxy/haproxy.pem
|
||||
args:
|
||||
creates: '{{ pki_dir }}/haproxy/haproxy.pem'
|
||||
when:
|
||||
- letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||||
- haproxy_enabled is defined and haproxy_enabled
|
||||
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue