Update ansible code
Some checks reported errors
continuous-integration/drone/push Build encountered an error

This commit is contained in:
Adrien Reslinger 2022-08-16 16:07:26 +02:00
parent f44a0ee2f5
commit 83170bbe6b
Signed by: adrien
GPG key ID: DA7B27055C66D6DE
5 changed files with 44 additions and 38 deletions

View file

@ -2,4 +2,3 @@
certbot_authtype: http certbot_authtype: http
certbot_authservice: httpd certbot_authservice: httpd
certbot_certname: '{{ ansible_fqdn }}' certbot_certname: '{{ ansible_fqdn }}'

View file

@ -1,7 +1,10 @@
--- ---
- name: Restart nginx - name: Restart nginx
service: name=nginx state=restarted ansible.builtin.service:
name: nginx
state: restarted
- name: Restart httpd - name: Restart httpd
service: name=httpd state=restarted ansible.builtin.service:
name: httpd
state: restarted

View file

@ -10,7 +10,9 @@ galaxy_info:
version: version:
- 7 - 7
- 8 - 8
- 9
- name: RedHat - name: RedHat
version: version:
- 7 - 7
- 8 - 8
- 9

View file

@ -1,15 +1,15 @@
--- ---
- name: Include vars for {{ ansible_os_family }} - name: Include vars for {{ ansible_os_family }}
include_vars: "{{ ansible_os_family }}.yml" ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
- name: install packages - name: install packages
package: ansible.builtin.package:
name: "{{ certbot_packages }}" name: "{{ certbot_packages }}"
state: present state: present
update_cache: yes update_cache: true
- name: Install httpd - name: Install httpd
include_role: ansible.builtin.include_role:
name: httpd name: httpd
vars: vars:
httpd_cerbot: false httpd_cerbot: false
@ -20,14 +20,17 @@
- certbot_authservice == "httpd" - certbot_authservice == "httpd"
#- name: install web service packages #- name: install web service packages
# package: name="{{ certbot_webpackages }}" state=latest update_cache=yes # ansible.builtin.package:
# name: "{{ certbot_webpackages }}"
# state: present
# update_cache: true
# notify: Restart httpd # notify: Restart httpd
# when: # when:
# - certbot_authtype == "http" # - certbot_authtype == "http"
# - certbot_authservice == "httpd" # - certbot_authservice == "httpd"
- name: Make the necessary directory - name: Make the necessary directory
file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
state: directory state: directory
owner: '{{ certbot_webuser }}' owner: '{{ certbot_webuser }}'
@ -40,7 +43,7 @@
- certbot_authtype == "http" - certbot_authtype == "http"
- name: Installation du fichier de verroux - name: Installation du fichier de verroux
copy: ansible.builtin.copy:
src: "{{ item }}" src: "{{ item }}"
dest: /var/www/.well-known/acme-challenge/{{ item }} dest: /var/www/.well-known/acme-challenge/{{ item }}
owner: root owner: root
@ -52,7 +55,7 @@
- certbot_authtype == "http" - certbot_authtype == "http"
- name: Installation de la configuration de la conf httpd - name: Installation de la configuration de la conf httpd
copy: ansible.builtin.copy:
src: httpd_letsencrypt.conf src: httpd_letsencrypt.conf
dest: /etc/httpd/conf.d/letsencrypt.conf dest: /etc/httpd/conf.d/letsencrypt.conf
owner: root owner: root
@ -64,7 +67,7 @@
- certbot_authservice == "httpd" - certbot_authservice == "httpd"
- name: Check if httpd is reloaded - name: Check if httpd is reloaded
service: ansible.builtin.service:
name: httpd name: httpd
state: reloaded state: reloaded
when: when:
@ -73,7 +76,7 @@
- need_reload_httpd is changed - need_reload_httpd is changed
- name: Installation de la configuration de la conf nginx - name: Installation de la configuration de la conf nginx
copy: ansible.builtin.copy:
src: nginx_letsencrypt.conf src: nginx_letsencrypt.conf
dest: /etc/nginx/site-enabled/ssl_force.conf dest: /etc/nginx/site-enabled/ssl_force.conf
owner: root owner: root
@ -85,7 +88,7 @@
- certbot_authservice == "nginx" - certbot_authservice == "nginx"
- name: Check if nginx is reloaded - name: Check if nginx is reloaded
service: ansible.builtin.service:
name: nginx name: nginx
state: reloaded state: reloaded
when: when:
@ -94,7 +97,7 @@
- need_reload_nginx|changed - need_reload_nginx|changed
#- name: Open Firewalld #- name: Open Firewalld
# firewalld: # ansible.posix.firewalld:
# service: http # service: http
# permanent: true # permanent: true
# state: enabled # state: enabled
@ -104,7 +107,7 @@
# - ansible_os_family == "RedHat" # - ansible_os_family == "RedHat"
- name: Installation des script pour le challenge DNS - name: Installation des script pour le challenge DNS
copy: ansible.builtin.copy:
src: etc/letsencrypt/{{ item }} src: etc/letsencrypt/{{ item }}
dest: /etc/letsencrypt/{{ item }} dest: /etc/letsencrypt/{{ item }}
owner: root owner: root
@ -117,7 +120,7 @@
- certbot_authtype == "dns" - certbot_authtype == "dns"
- name: Installation de la configuration pour le chalenge DNS via OVH - name: Installation de la configuration pour le chalenge DNS via OVH
template: ansible.builtin.template:
src: etc/letsencrypt/ovh-api-keys.j2 src: etc/letsencrypt/ovh-api-keys.j2
dest: /etc/letsencrypt/ovh-api-keys dest: /etc/letsencrypt/ovh-api-keys
owner: root owner: root
@ -128,7 +131,7 @@
- certbot_authdns_provider == "ovh" - certbot_authdns_provider == "ovh"
- name: Installation de la configuration pour le chalenge DNS via Gandi - name: Installation de la configuration pour le chalenge DNS via Gandi
template: ansible.builtin.template:
src: etc/letsencrypt/gandi-api-keys.j2 src: etc/letsencrypt/gandi-api-keys.j2
dest: /etc/letsencrypt/gandi-api-keys dest: /etc/letsencrypt/gandi-api-keys
owner: root owner: root
@ -139,12 +142,12 @@
- certbot_authdns_provider == "gandi" - certbot_authdns_provider == "gandi"
- name: Check if certificat already exist - name: Check if certificat already exist
stat: ansible.builtin.stat:
path: /etc/letsencrypt/live/{{ certbot_certname }}/fullchain.pem path: /etc/letsencrypt/live/{{ certbot_certname }}/fullchain.pem
register: cert register: cert
- name: Install certbot and generate cert - name: Install certbot and generate cert
command: > ansible.builtin.command: >
certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok
--renew-by-default --text --webroot --webroot-path /var/www/ --renew-by-default --text --webroot --webroot-path /var/www/
--email {{ certbot_adminemail }} -d {{ certbot_certname }} --email {{ certbot_adminemail }} -d {{ certbot_certname }}
@ -153,7 +156,7 @@
- certbot_authtype == "http" - certbot_authtype == "http"
- name: Install certbot and generate cert - name: Install certbot and generate cert
command: > ansible.builtin.command: >
certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok
--renew-by-default --text --manual --manual-auth-hook "/etc/letsencrypt/lexicon-ovh.sh create" --renew-by-default --text --manual --manual-auth-hook "/etc/letsencrypt/lexicon-ovh.sh create"
--manual-cleanup-hook "/etc/letsencrypt/lexicon-ovh.sh delete" --preferred-challenges dns --manual-cleanup-hook "/etc/letsencrypt/lexicon-ovh.sh delete" --preferred-challenges dns
@ -163,13 +166,13 @@
- certbot_authtype == "dns" - certbot_authtype == "dns"
# - name: Ensure a cron job to auto-renew the cert exists # - name: Ensure a cron job to auto-renew the cert exists
# cron: name="daily auto renew cert" # ansible.builtin.cron: name="daily auto renew cert"
# special_time=daily # special_time=daily
# job="certbot renew --webroot --webroot-path /var/www/ --no-self-upgrade --post-hook \"systemctl reload httpd\" --quiet" # job="certbot renew --webroot --webroot-path /var/www/ --no-self-upgrade --post-hook \"systemctl reload httpd\" --quiet"
# state=present # state=present
## when: certbot_auto_renew ## when: certbot_auto_renew
- name: Ensure a cron job to auto-renew the cert exists - name: Ensure a cron job to auto-renew the cert exists
cron: ansible.builtin.cron:
name: "daily auto renew cert" name: "daily auto renew cert"
special_time: daily special_time: daily
job: "certbot renew --quiet" job: "certbot renew --quiet"

View file

@ -9,4 +9,3 @@ certbot_webpackages:
# - {% if certbot_authservice == 'httpd' %}httpd{% elif certbot_authservice == 'nginx' %}nginx{% endif %} # - {% if certbot_authservice == 'httpd' %}httpd{% elif certbot_authservice == 'nginx' %}nginx{% endif %}
- httpd - httpd
certbot_webuser: apache certbot_webuser: apache