82 lines
3.8 KiB
YAML
82 lines
3.8 KiB
YAML
---
|
|
- block:
|
|
- name: Install the apache letsencrypt directives on trusty
|
|
template: src=letsencrypt-proxy.conf.j2 dest=/etc/apache2/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
|
|
when: ansible_distribution_file_variety == "Debian"
|
|
notify: httpd reload
|
|
|
|
- name: Install the apache letsencrypt directives on CentOS
|
|
template: src=letsencrypt-proxy.conf.j2 dest=/etc/httpd/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
|
|
when: ansible_distribution_file_variety == "RedHat"
|
|
notify: httpd reload
|
|
|
|
- name: Create the acme hooks directory if it does not yet exist
|
|
file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
|
|
|
|
- name: Install a letsencrypt hook that fixes the letsencrypt certificate for ipa and then reloads the service
|
|
template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=0550
|
|
when: ipa_ssl_letsencrypt_use_hook | bool
|
|
|
|
- name: Install a script that fixes the letsencrypt certificate for ipa and then reloads the service
|
|
template: src=ipa-letsencrypt-acmetool.sh dest=/usr/local/bin/ipa-letsencrypt owner=root group=root mode=0500
|
|
when: not ipa_ssl_letsencrypt_use_hook | bool
|
|
tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]
|
|
|
|
- name: Install a cron job that runs the ipa-letsencrypt script
|
|
cron: name="Refresh-the-letsencrypt-certificate-configured-in-FreeIPA" job="/usr/local/bin/ipa-letsencrypt >/var/log/acme/ipa-letsencrypt.log 2>&1" user=root hour="{{ range(1, 4) | random }}" minute="{{ range(0, 59) | random }}" day={{ ipa_letsencrypt_cron_job_day }} state=present
|
|
when: not ipa_ssl_letsencrypt_use_hook | bool
|
|
tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]
|
|
|
|
- name: Create the ipa certificate directory
|
|
file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750
|
|
|
|
- name: Install the Letsencrypt CA file with both the root and the trusted CAs
|
|
copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0440
|
|
|
|
- name: Copy the certificate file into /etc/pki/ipa
|
|
copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True mode=0440
|
|
|
|
- name: Copy the certificate key file into /etc/pki/ipa
|
|
copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True mode=0440
|
|
|
|
- name: Put chain and cert in a single file. Needed once for the first configuration
|
|
shell: cat /etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem > /etc/pki/ipa/fullchain.pem ; chmod 400 /etc/pki/ipa/fullchain.pem
|
|
args:
|
|
creates: '/etc/pki/ipa/fullchain.pem'
|
|
|
|
when:
|
|
- ipa_ssl_letsencrypt_managed | bool
|
|
- letsencrypt_acme_install | bool
|
|
tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt' ]
|
|
|
|
- block:
|
|
- name: Install the FreeIPA server packages
|
|
yum: pkg={{ ipa_server_packages }} state=latest
|
|
|
|
- name: Install the FreeIPA DNS server packages
|
|
yum: pkg={{ ipa_server_dns_packages }} state=latest
|
|
|
|
- name: Remove the packages that conflict with the FreeIPA server configuration
|
|
yum: pkg={{ ipa_packages_to_remove }} state=absent
|
|
|
|
- name: Ensure that the ntpd service is started and enabled
|
|
service: name=ntpd state=started enabled=yes
|
|
|
|
when:
|
|
- ipa_server_install | bool
|
|
- ansible_distribution_file_variety == "RedHat"
|
|
tags: [ 'ipa' ]
|
|
|
|
- block:
|
|
- name: Run the ipa-server-install command unattended.
|
|
command: ipa-server-install {{ ipa_installation_options }}
|
|
args:
|
|
creates: /var/lib/ipa/dnssec/softhsm_pin
|
|
|
|
when:
|
|
- ipa_server_install | bool
|
|
- ipa_server_is_master | bool
|
|
- ansible_distribution_file_variety == "RedHat"
|
|
- ipa_run_the_installation_command | bool
|
|
tags: [ 'ipa' ]
|