tpiccioli
/
ansible-roles
forked from ISTI-ansible-roles/ansible-roles
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

haproxy: Run the OCSP stapling script after a certificate has been renewed. See https://support.d4science.org/issues/10008

This commit is contained in:
Andrea Dell'Amico 2017-10-27 12:49:50 +02:00
parent 3aa7de0d40
commit 70b1b52976
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
haproxy/tasks/haproxy-letsencrypt-acmetool.yml
View File

@ -7,7 +7,7 @@
tags: [ 'haproxy', 'letsencrypt' ] tags: [ 'haproxy', 'letsencrypt' ]
- name: Install a script that fix the letsencrypt certificate for haproxy and then reload the service - name: Install a script that fix the letsencrypt certificate for haproxy and then reload the service
copy: src=haproxy-letsencrypt-acme.sh dest={{ letsencrypt_acme_services_scripts_dir }}/haproxy owner=root group=root mode=4555 template: src=haproxy-letsencrypt-acme.sh.j2 dest={{ letsencrypt_acme_services_scripts_dir }}/haproxy owner=root group=root mode=4555
when: when:
- haproxy_letsencrypt_managed - haproxy_letsencrypt_managed
- letsencrypt_acme_install - letsencrypt_acme_install

2
haproxy/tasks/haproxy-ssl.yml
View File

@ -8,7 +8,7 @@
- name: Install a cron job that refreshes the OCSP configuration - name: Install a cron job that refreshes the OCSP configuration
cron: cron:
name: "Refresh haproxy OCSP information" name: "Refresh the haproxy OCSP information"
user: root user: root
special_time: daily special_time: daily
job: "/usr/local/bin/hapos-upd --cert {{ haproxy_cert_dir }}/haproxy.pem -v {{ letsencrypt_acme_certs_dir }}/fullchain -s {{ haproxy_admin_socket }} >/var/log/hapos-upd.log 2>&1" job: "/usr/local/bin/hapos-upd --cert {{ haproxy_cert_dir }}/haproxy.pem -v {{ letsencrypt_acme_certs_dir }}/fullchain -s {{ haproxy_admin_socket }} >/var/log/hapos-upd.log 2>&1"

6
haproxy/files/haproxy-letsencrypt-acme.sh → haproxy/templates/haproxy-letsencrypt-acme.sh.j2
View File

@ -30,6 +30,12 @@ else
service haproxy reload >> $LE_LOG_DIR/haproxy.log 2>&1 service haproxy reload >> $LE_LOG_DIR/haproxy.log 2>&1
fi fi
# Run the OCSP stapling script
if [ -x /usr/local/bin/hapos-upd ] ; then
echo "Run the OCSP stapling script" >> $LE_LOG_DIR/haproxy.log
/usr/local/bin/hapos-upd --cert {{ haproxy_cert_dir }}/haproxy.pem -v {{ letsencrypt_acme_certs_dir }}/fullchain -s {{ haproxy_admin_socket }} >> $LE_LOG_DIR/haproxy.log 2>&1
fi
echo "Done." >> $LE_LOG_DIR/haproxy.log echo "Done." >> $LE_LOG_DIR/haproxy.log
exit 0 exit 0