forked from ISTI-ansible-roles/ansible-roles
56 lines
3.5 KiB
YAML
56 lines
3.5 KiB
YAML
|
---
|
||
|
|
- name: Ensure that the PKI directory exists
|
||
|
|
file: path={{ pki_dir }} state=directory owner=root group=root mode=0755
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: Ensure that the PKI subdirectories exist
|
||
|
|
file: path={{ pki_dir }}/{{ item }} state=directory owner=root group=root mode=0755
|
||
|
|
with_items: '{{ pki_subdirs }}'
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the physical paths
|
||
|
|
file: path={{ item }} mode=0755 state=directory
|
||
|
|
with_items:
|
||
|
|
- '{{ letsencrypt_acme_user_home }}/live'
|
||
|
|
- '{{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert'
|
||
|
|
- '{{ letsencrypt_acme_user_home }}/keys/fakeselfsignedcert'
|
||
|
|
when: letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the certificate and private key
|
||
|
|
command: openssl req -x509 -newkey rsa:2048 -keyout {{ letsencrypt_acme_user_home }}/keys/fakeselfsignedcert/privkey -out {{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/cert -days 10 -nodes -subj '/CN=self signed certificate'
|
||
|
|
args:
|
||
|
|
creates: '{{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/cert'
|
||
|
|
when: letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the private key
|
||
|
|
file: src={{ letsencrypt_acme_user_home }}/keys/fakeselfsignedcert/privkey dest={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/privkey state=link
|
||
|
|
when: letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the chain file
|
||
|
|
file: src={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/cert dest={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert/chain state=link
|
||
|
|
when: letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Check if a certificate already exists
|
||
|
|
stat: path={{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }}
|
||
|
|
register: true_cert
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now the symbolic links for the certificate if there is not one
|
||
|
|
file: src={{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert dest={{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }} state=link
|
||
|
|
when: true_cert.stat.islnk is defined and true_cert.stat.islnk == False
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|
||
|
|
- name: When we are going to install letsencrypt certificates, create a preliminary path and a self signed cert. Now handle the haproxy special case
|
||
|
|
command: mkdir {{ pki_dir }}/haproxy ; cat {{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }}/privkey {{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }}/cert > {{ pki_dir }}/haproxy/haproxy.pem
|
||
|
|
args:
|
||
|
|
creates: '{{ pki_dir }}/haproxy/haproxy.pem'
|
||
|
|
when:
|
||
|
|
- letsencrypt_acme_install is defined and letsencrypt_acme_install
|
||
|
|
- haproxy_enabled is defined and haproxy_enabled
|
||
|
|
tags: [ 'pki', 'ssl', 'letsencrypt' ]
|
||
|
|
|