forked from ISTI-ansible-roles/ansible-roles
127 lines
5.1 KiB
YAML
127 lines
5.1 KiB
YAML
---
|
|
- name: Install the letsencrypt acmetool repo on ubuntu
|
|
apt_repository: repo={{ letsencrypt_acme_ppa_repo }} state=present update_cache=yes
|
|
when:
|
|
- letsencrypt_acme_install
|
|
- is_ubuntu
|
|
notify: Initialize letsencrypt acmetool
|
|
tags: letsencrypt
|
|
|
|
- name: Install the letsencrypt acmetool repo key on debian
|
|
apt_key: keyserver=keyserver.ubuntu.com id={{ letsencrypt_acme_debian_repo_key }}
|
|
when:
|
|
- letsencrypt_acme_install
|
|
- is_debian
|
|
tags: letsencrypt
|
|
|
|
- name: Install the letsencrypt acmetool repo on debian
|
|
apt_repository: repo={{ letsencrypt_acme_debian_repo }} state=present update_cache=yes
|
|
when:
|
|
- letsencrypt_acme_install
|
|
- is_debian
|
|
notify: Initialize letsencrypt acmetool
|
|
tags: letsencrypt
|
|
|
|
- name: Create the letsencrytp acme user
|
|
user: name={{ letsencrypt_acme_user }} home={{ letsencrypt_acme_user_home }} createhome=no shell=/bin/bash
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Create the letsencrytp acme home, if it does not exist already. In a separate step because it could be already there.
|
|
file: dest={{ letsencrypt_acme_user_home }} owner={{ letsencrypt_acme_user }} group={{ letsencrypt_acme_user }} state=directory recurse=yes
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Install the letsencrypt acmetool package
|
|
apt: pkg=acmetool state=installed
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Create the letsencrypt acme config directory
|
|
become: True
|
|
become_user: '{{ letsencrypt_acme_user }}'
|
|
file: dest={{ letsencrypt_acme_config_dir }} state=directory mode=0755
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Create the letsencrypt acme desired domains directory
|
|
become: True
|
|
become_user: '{{ letsencrypt_acme_user }}'
|
|
file: dest={{ letsencrypt_acme_certsconf_dir }} state=directory mode=0755
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Create the letsencrypt acme hooks directory
|
|
file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root mode=0755
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Install a default file that shell scripts can include
|
|
template: src=letsencrypt-default.j2 dest=/etc/default/letsencrypt owner=root group=root mode=0644
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Install the letsencrypt acme responses file
|
|
become: True
|
|
become_user: '{{ letsencrypt_acme_user }}'
|
|
template: src=responses.j2 dest={{ letsencrypt_acme_config_dir }}/responses mode=0644
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Install the letsencrypt acme certs config file
|
|
become: True
|
|
become_user: '{{ letsencrypt_acme_user }}'
|
|
template: src=cert-requirements.j2 dest={{ letsencrypt_acme_certsconf_dir }}/{{ ansible_fqdn }} mode=0644
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Set the cap_net_bind_service capability to the acmetool binary when we use it in listener mode
|
|
capabilities: path=/usr/bin/acmetool capability=cap_net_bind_service+ep state=present
|
|
when:
|
|
- letsencrypt_acme_install
|
|
- "'{{ letsencrypt_acme_authenticator }}' == 'listener'"
|
|
tags: letsencrypt
|
|
|
|
- name: Remove the cap_net_bind_service capability to the acmetool binary if not needed
|
|
capabilities: path=/usr/bin/acmetool capability=cap_net_bind_service+ep state=absent
|
|
when:
|
|
- letsencrypt_acme_install
|
|
- "'{{ letsencrypt_acme_authenticator }}' != 'listener'"
|
|
tags: letsencrypt
|
|
|
|
- name: Install the sudoers config needed to run the acmetool hooks
|
|
template: src=acme-sudoers.j2 dest=/etc/sudoers.d/letsencrypt-acme owner=root group=root mode=0440
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Create a directory where to put the cron job and hooks logs
|
|
file: dest={{ letsencrypt_acme_log_dir }} state=directory owner={{ letsencrypt_acme_user }} group={{ letsencrypt_acme_user }} mode=0750
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: Install a daily cron job to renew the certificates when needed
|
|
cron: name="Letsencrypt certificate renewal" special_time=daily job="{{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} reconcile > {{ letsencrypt_acme_log_dir }}/acme-cron.log 2>&1" user={{ letsencrypt_acme_user }}
|
|
when: letsencrypt_acme_install
|
|
tags: letsencrypt
|
|
|
|
- name: letsencrypt acmetool initializaztion
|
|
become: True
|
|
become_user: '{{ letsencrypt_acme_user }}'
|
|
shell: 'rm -fr {{ letsencrypt_acme_user_home }}/certs/fakeselfsignedcert ; rm -fr {{ letsencrypt_acme_user_home }}/keys/fakeselfsigned/cert ; rm {{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }} ; {{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} quickstart'
|
|
args:
|
|
creates: '{{ letsencrypt_acme_user_home }}/accounts'
|
|
when: letsencrypt_acme_install
|
|
ignore_errors: True
|
|
tags: letsencrypt
|
|
|
|
- name: letsencrypt acmetool request the first certificate
|
|
become: True
|
|
become_user: '{{ letsencrypt_acme_user }}'
|
|
command: '{{ letsencrypt_acme_command }} {{ letsencrypt_acme_command_opts }} reconcile'
|
|
args:
|
|
creates: '{{ letsencrypt_acme_certs_dir }}/cert'
|
|
when: letsencrypt_acme_install
|
|
ignore_errors: True
|
|
tags: letsencrypt
|
|
|