Update ansible code
Some checks reported errors
continuous-integration/drone/push Build encountered an error
Some checks reported errors
continuous-integration/drone/push Build encountered an error
This commit is contained in:
parent
f44a0ee2f5
commit
83170bbe6b
5 changed files with 44 additions and 38 deletions
|
|
@ -2,4 +2,3 @@
|
||||||
certbot_authtype: http
|
certbot_authtype: http
|
||||||
certbot_authservice: httpd
|
certbot_authservice: httpd
|
||||||
certbot_certname: '{{ ansible_fqdn }}'
|
certbot_certname: '{{ ansible_fqdn }}'
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,10 @@
|
||||||
---
|
---
|
||||||
- name: Restart nginx
|
- name: Restart nginx
|
||||||
service: name=nginx state=restarted
|
ansible.builtin.service:
|
||||||
|
name: nginx
|
||||||
|
state: restarted
|
||||||
|
|
||||||
- name: Restart httpd
|
- name: Restart httpd
|
||||||
service: name=httpd state=restarted
|
ansible.builtin.service:
|
||||||
|
name: httpd
|
||||||
|
state: restarted
|
||||||
|
|
|
||||||
|
|
@ -10,7 +10,9 @@ galaxy_info:
|
||||||
version:
|
version:
|
||||||
- 7
|
- 7
|
||||||
- 8
|
- 8
|
||||||
|
- 9
|
||||||
- name: RedHat
|
- name: RedHat
|
||||||
version:
|
version:
|
||||||
- 7
|
- 7
|
||||||
- 8
|
- 8
|
||||||
|
- 9
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,15 @@
|
||||||
---
|
---
|
||||||
- name: Include vars for {{ ansible_os_family }}
|
- name: Include vars for {{ ansible_os_family }}
|
||||||
include_vars: "{{ ansible_os_family }}.yml"
|
ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
|
||||||
|
|
||||||
- name: install packages
|
- name: install packages
|
||||||
package:
|
ansible.builtin.package:
|
||||||
name: "{{ certbot_packages }}"
|
name: "{{ certbot_packages }}"
|
||||||
state: present
|
state: present
|
||||||
update_cache: yes
|
update_cache: true
|
||||||
|
|
||||||
- name: Install httpd
|
- name: Install httpd
|
||||||
include_role:
|
ansible.builtin.include_role:
|
||||||
name: httpd
|
name: httpd
|
||||||
vars:
|
vars:
|
||||||
httpd_cerbot: false
|
httpd_cerbot: false
|
||||||
|
|
@ -20,14 +20,17 @@
|
||||||
- certbot_authservice == "httpd"
|
- certbot_authservice == "httpd"
|
||||||
|
|
||||||
#- name: install web service packages
|
#- name: install web service packages
|
||||||
# package: name="{{ certbot_webpackages }}" state=latest update_cache=yes
|
# ansible.builtin.package:
|
||||||
|
# name: "{{ certbot_webpackages }}"
|
||||||
|
# state: present
|
||||||
|
# update_cache: true
|
||||||
# notify: Restart httpd
|
# notify: Restart httpd
|
||||||
# when:
|
# when:
|
||||||
# - certbot_authtype == "http"
|
# - certbot_authtype == "http"
|
||||||
# - certbot_authservice == "httpd"
|
# - certbot_authservice == "httpd"
|
||||||
|
|
||||||
- name: Make the necessary directory
|
- name: Make the necessary directory
|
||||||
file:
|
ansible.builtin.file:
|
||||||
path: "{{ item }}"
|
path: "{{ item }}"
|
||||||
state: directory
|
state: directory
|
||||||
owner: '{{ certbot_webuser }}'
|
owner: '{{ certbot_webuser }}'
|
||||||
|
|
@ -40,7 +43,7 @@
|
||||||
- certbot_authtype == "http"
|
- certbot_authtype == "http"
|
||||||
|
|
||||||
- name: Installation du fichier de verroux
|
- name: Installation du fichier de verroux
|
||||||
copy:
|
ansible.builtin.copy:
|
||||||
src: "{{ item }}"
|
src: "{{ item }}"
|
||||||
dest: /var/www/.well-known/acme-challenge/{{ item }}
|
dest: /var/www/.well-known/acme-challenge/{{ item }}
|
||||||
owner: root
|
owner: root
|
||||||
|
|
@ -52,7 +55,7 @@
|
||||||
- certbot_authtype == "http"
|
- certbot_authtype == "http"
|
||||||
|
|
||||||
- name: Installation de la configuration de la conf httpd
|
- name: Installation de la configuration de la conf httpd
|
||||||
copy:
|
ansible.builtin.copy:
|
||||||
src: httpd_letsencrypt.conf
|
src: httpd_letsencrypt.conf
|
||||||
dest: /etc/httpd/conf.d/letsencrypt.conf
|
dest: /etc/httpd/conf.d/letsencrypt.conf
|
||||||
owner: root
|
owner: root
|
||||||
|
|
@ -64,7 +67,7 @@
|
||||||
- certbot_authservice == "httpd"
|
- certbot_authservice == "httpd"
|
||||||
|
|
||||||
- name: Check if httpd is reloaded
|
- name: Check if httpd is reloaded
|
||||||
service:
|
ansible.builtin.service:
|
||||||
name: httpd
|
name: httpd
|
||||||
state: reloaded
|
state: reloaded
|
||||||
when:
|
when:
|
||||||
|
|
@ -73,7 +76,7 @@
|
||||||
- need_reload_httpd is changed
|
- need_reload_httpd is changed
|
||||||
|
|
||||||
- name: Installation de la configuration de la conf nginx
|
- name: Installation de la configuration de la conf nginx
|
||||||
copy:
|
ansible.builtin.copy:
|
||||||
src: nginx_letsencrypt.conf
|
src: nginx_letsencrypt.conf
|
||||||
dest: /etc/nginx/site-enabled/ssl_force.conf
|
dest: /etc/nginx/site-enabled/ssl_force.conf
|
||||||
owner: root
|
owner: root
|
||||||
|
|
@ -85,7 +88,7 @@
|
||||||
- certbot_authservice == "nginx"
|
- certbot_authservice == "nginx"
|
||||||
|
|
||||||
- name: Check if nginx is reloaded
|
- name: Check if nginx is reloaded
|
||||||
service:
|
ansible.builtin.service:
|
||||||
name: nginx
|
name: nginx
|
||||||
state: reloaded
|
state: reloaded
|
||||||
when:
|
when:
|
||||||
|
|
@ -94,7 +97,7 @@
|
||||||
- need_reload_nginx|changed
|
- need_reload_nginx|changed
|
||||||
|
|
||||||
#- name: Open Firewalld
|
#- name: Open Firewalld
|
||||||
# firewalld:
|
# ansible.posix.firewalld:
|
||||||
# service: http
|
# service: http
|
||||||
# permanent: true
|
# permanent: true
|
||||||
# state: enabled
|
# state: enabled
|
||||||
|
|
@ -104,7 +107,7 @@
|
||||||
# - ansible_os_family == "RedHat"
|
# - ansible_os_family == "RedHat"
|
||||||
|
|
||||||
- name: Installation des script pour le challenge DNS
|
- name: Installation des script pour le challenge DNS
|
||||||
copy:
|
ansible.builtin.copy:
|
||||||
src: etc/letsencrypt/{{ item }}
|
src: etc/letsencrypt/{{ item }}
|
||||||
dest: /etc/letsencrypt/{{ item }}
|
dest: /etc/letsencrypt/{{ item }}
|
||||||
owner: root
|
owner: root
|
||||||
|
|
@ -117,7 +120,7 @@
|
||||||
- certbot_authtype == "dns"
|
- certbot_authtype == "dns"
|
||||||
|
|
||||||
- name: Installation de la configuration pour le chalenge DNS via OVH
|
- name: Installation de la configuration pour le chalenge DNS via OVH
|
||||||
template:
|
ansible.builtin.template:
|
||||||
src: etc/letsencrypt/ovh-api-keys.j2
|
src: etc/letsencrypt/ovh-api-keys.j2
|
||||||
dest: /etc/letsencrypt/ovh-api-keys
|
dest: /etc/letsencrypt/ovh-api-keys
|
||||||
owner: root
|
owner: root
|
||||||
|
|
@ -128,7 +131,7 @@
|
||||||
- certbot_authdns_provider == "ovh"
|
- certbot_authdns_provider == "ovh"
|
||||||
|
|
||||||
- name: Installation de la configuration pour le chalenge DNS via Gandi
|
- name: Installation de la configuration pour le chalenge DNS via Gandi
|
||||||
template:
|
ansible.builtin.template:
|
||||||
src: etc/letsencrypt/gandi-api-keys.j2
|
src: etc/letsencrypt/gandi-api-keys.j2
|
||||||
dest: /etc/letsencrypt/gandi-api-keys
|
dest: /etc/letsencrypt/gandi-api-keys
|
||||||
owner: root
|
owner: root
|
||||||
|
|
@ -139,12 +142,12 @@
|
||||||
- certbot_authdns_provider == "gandi"
|
- certbot_authdns_provider == "gandi"
|
||||||
|
|
||||||
- name: Check if certificat already exist
|
- name: Check if certificat already exist
|
||||||
stat:
|
ansible.builtin.stat:
|
||||||
path: /etc/letsencrypt/live/{{ certbot_certname }}/fullchain.pem
|
path: /etc/letsencrypt/live/{{ certbot_certname }}/fullchain.pem
|
||||||
register: cert
|
register: cert
|
||||||
|
|
||||||
- name: Install certbot and generate cert
|
- name: Install certbot and generate cert
|
||||||
command: >
|
ansible.builtin.command: >
|
||||||
certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok
|
certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok
|
||||||
--renew-by-default --text --webroot --webroot-path /var/www/
|
--renew-by-default --text --webroot --webroot-path /var/www/
|
||||||
--email {{ certbot_adminemail }} -d {{ certbot_certname }}
|
--email {{ certbot_adminemail }} -d {{ certbot_certname }}
|
||||||
|
|
@ -153,7 +156,7 @@
|
||||||
- certbot_authtype == "http"
|
- certbot_authtype == "http"
|
||||||
|
|
||||||
- name: Install certbot and generate cert
|
- name: Install certbot and generate cert
|
||||||
command: >
|
ansible.builtin.command: >
|
||||||
certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok
|
certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok
|
||||||
--renew-by-default --text --manual --manual-auth-hook "/etc/letsencrypt/lexicon-ovh.sh create"
|
--renew-by-default --text --manual --manual-auth-hook "/etc/letsencrypt/lexicon-ovh.sh create"
|
||||||
--manual-cleanup-hook "/etc/letsencrypt/lexicon-ovh.sh delete" --preferred-challenges dns
|
--manual-cleanup-hook "/etc/letsencrypt/lexicon-ovh.sh delete" --preferred-challenges dns
|
||||||
|
|
@ -162,14 +165,14 @@
|
||||||
- not cert.stat.exists
|
- not cert.stat.exists
|
||||||
- certbot_authtype == "dns"
|
- certbot_authtype == "dns"
|
||||||
|
|
||||||
#- name: Ensure a cron job to auto-renew the cert exists
|
# - name: Ensure a cron job to auto-renew the cert exists
|
||||||
# cron: name="daily auto renew cert"
|
# ansible.builtin.cron: name="daily auto renew cert"
|
||||||
# special_time=daily
|
# special_time=daily
|
||||||
# job="certbot renew --webroot --webroot-path /var/www/ --no-self-upgrade --post-hook \"systemctl reload httpd\" --quiet"
|
# job="certbot renew --webroot --webroot-path /var/www/ --no-self-upgrade --post-hook \"systemctl reload httpd\" --quiet"
|
||||||
# state=present
|
# state=present
|
||||||
## when: certbot_auto_renew
|
## when: certbot_auto_renew
|
||||||
- name: Ensure a cron job to auto-renew the cert exists
|
- name: Ensure a cron job to auto-renew the cert exists
|
||||||
cron:
|
ansible.builtin.cron:
|
||||||
name: "daily auto renew cert"
|
name: "daily auto renew cert"
|
||||||
special_time: daily
|
special_time: daily
|
||||||
job: "certbot renew --quiet"
|
job: "certbot renew --quiet"
|
||||||
|
|
|
||||||
|
|
@ -9,4 +9,3 @@ certbot_webpackages:
|
||||||
# - {% if certbot_authservice == 'httpd' %}httpd{% elif certbot_authservice == 'nginx' %}nginx{% endif %}
|
# - {% if certbot_authservice == 'httpd' %}httpd{% elif certbot_authservice == 'nginx' %}nginx{% endif %}
|
||||||
- httpd
|
- httpd
|
||||||
certbot_webuser: apache
|
certbot_webuser: apache
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue