This commit is contained in:
parent
64c5691975
commit
c723d4c83d
1 changed files with 61 additions and 17 deletions
|
|
@ -3,7 +3,10 @@
|
|||
include_vars: "{{ ansible_os_family }}.yml"
|
||||
|
||||
- name: install packages
|
||||
package: name="{{ certbot_packages }}" state=latest update_cache=yes
|
||||
package:
|
||||
name: "{{ certbot_packages }}"
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Install httpd
|
||||
include_role:
|
||||
|
|
@ -24,7 +27,12 @@
|
|||
# - certbot_authservice == "httpd"
|
||||
|
||||
- name: Make the necessary directory
|
||||
file: path="{{ item }}" state=directory owner={{ certbot_webuser }} group={{ certbot_webuser }} mode=0755
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: {{ certbot_webuser }}
|
||||
group: {{ certbot_webuser }}
|
||||
mode: 0755
|
||||
with_items:
|
||||
- /var/www/.well-known
|
||||
- /var/www/.well-known/acme-challenge
|
||||
|
|
@ -32,35 +40,54 @@
|
|||
- certbot_authtype == "http"
|
||||
|
||||
- name: Installation du fichier de verroux
|
||||
copy: src={{ item }} dest=/var/www/.well-known/acme-challenge/{{ item }} owner=root group=root mode=0644
|
||||
copy:
|
||||
src: {{ item }}
|
||||
dest: /var/www/.well-known/acme-challenge/{{ item }}
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
with_items:
|
||||
- test.html
|
||||
when:
|
||||
- certbot_authtype == "http"
|
||||
|
||||
- name: Installation de la configuration de la conf httpd
|
||||
copy: src=httpd_letsencrypt.conf dest=/etc/httpd/conf.d/letsencrypt.conf owner=root group=root mode=0644
|
||||
copy:
|
||||
src: httpd_letsencrypt.conf
|
||||
dest: /etc/httpd/conf.d/letsencrypt.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
register: need_reload_httpd
|
||||
when:
|
||||
- certbot_authtype == "http"
|
||||
- certbot_authservice == "httpd"
|
||||
|
||||
- name: Check if httpd is reloaded
|
||||
service: name=httpd state=reloaded
|
||||
service:
|
||||
name: httpd
|
||||
state: reloaded
|
||||
when:
|
||||
- certbot_authtype == "http"
|
||||
- certbot_authservice == "httpd"
|
||||
- need_reload_httpd is changed
|
||||
|
||||
- name: Installation de la configuration de la conf nginx
|
||||
copy: src=nginx_letsencrypt.conf dest=/etc/nginx/site-enabled/ssl_force.conf owner=root group=root mode=0644
|
||||
copy:
|
||||
src: nginx_letsencrypt.conf
|
||||
dest: /etc/nginx/site-enabled/ssl_force.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
register: need_reload_nginx
|
||||
when:
|
||||
- certbot_authtype == "http"
|
||||
- certbot_authservice == "nginx"
|
||||
|
||||
- name: Check if nginx is reloaded
|
||||
service: name=nginx state=reloaded
|
||||
service:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
when:
|
||||
- certbot_authtype == "http"
|
||||
- certbot_authservice == "nginx"
|
||||
|
|
@ -77,7 +104,12 @@
|
|||
# - ansible_os_family == "RedHat"
|
||||
|
||||
- name: Installation des script pour le challenge DNS
|
||||
copy: src=etc/letsencrypt/{{ item }} dest=/etc/letsencrypt/{{ item }} owner=root group=root mode=0755
|
||||
copy:
|
||||
src: etc/letsencrypt/{{ item }}
|
||||
dest: /etc/letsencrypt/{{ item }}
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
with_item:
|
||||
- lexicon-ovh.sh
|
||||
- lexicon-gandi.sh
|
||||
|
|
@ -85,29 +117,40 @@
|
|||
- certbot_authtype == "dns"
|
||||
|
||||
- name: Installation de la configuration pour le chalenge DNS via OVH
|
||||
template: src=etc/letsencrypt/ovh-api-keys.j2 dest=/etc/letsencrypt/ovh-api-keys owner=root group=root mode=0755
|
||||
template:
|
||||
src: etc/letsencrypt/ovh-api-keys.j2
|
||||
dest: /etc/letsencrypt/ovh-api-keys
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when:
|
||||
- certbot_authtype == "dns"
|
||||
- certbot_authdns_provider == "ovh"
|
||||
|
||||
- name: Installation de la configuration pour le chalenge DNS via Gandi
|
||||
template: src=etc/letsencrypt/gandi-api-keys.j2 dest=/etc/letsencrypt/gandi-api-keys owner=root group=root mode=0755
|
||||
template:
|
||||
src: etc/letsencrypt/gandi-api-keys.j2
|
||||
dest: /etc/letsencrypt/gandi-api-keys
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when:
|
||||
- certbot_authtype == "dns"
|
||||
- certbot_authdns_provider == "gandi"
|
||||
|
||||
- name: Check if certificat already exist
|
||||
stat: path=/etc/letsencrypt/live/{{ certbot_certname }}/fullchain.pem
|
||||
stat:
|
||||
path: /etc/letsencrypt/live/{{ certbot_certname }}/fullchain.pem
|
||||
register: cert
|
||||
|
||||
- name: Install certbot and generate cert
|
||||
command: "certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok --renew-by-default --text --webroot --webroot-path /var/www/ --email {{ certbot_adminemail }} -d {{ certbot_certname }}"
|
||||
command: certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok --renew-by-default --text --webroot --webroot-path /var/www/ --email {{ certbot_adminemail }} -d {{ certbot_certname }}
|
||||
when:
|
||||
- not cert.stat.exists
|
||||
- certbot_authtype == "http"
|
||||
|
||||
- name: Install certbot and generate cert
|
||||
command: "certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok --renew-by-default --text --manual --manual-auth-hook "/etc/letsencrypt/lexicon-ovh.sh create" --manual-cleanup-hook "/etc/letsencrypt/lexicon-ovh.sh delete" --preferred-challenges dns --email {{ certbot_adminemail }} -d {{ certbot_certname }}"
|
||||
command: certbot certonly --noninteractive --agree-tos --manual-public-ip-logging-ok --renew-by-default --text --manual --manual-auth-hook "/etc/letsencrypt/lexicon-ovh.sh create" --manual-cleanup-hook "/etc/letsencrypt/lexicon-ovh.sh delete" --preferred-challenges dns --email {{ certbot_adminemail }} -d {{ certbot_certname }}
|
||||
when:
|
||||
- not cert.stat.exists
|
||||
- certbot_authtype == "dns"
|
||||
|
|
@ -119,8 +162,9 @@
|
|||
# state=present
|
||||
## when: certbot_auto_renew
|
||||
- name: Ensure a cron job to auto-renew the cert exists
|
||||
cron: name="daily auto renew cert"
|
||||
special_time=daily
|
||||
job="certbot renew --quiet"
|
||||
state=present
|
||||
cron:
|
||||
name: "daily auto renew cert"
|
||||
special_time: daily
|
||||
job: "certbot renew --quiet"
|
||||
state: present
|
||||
# when: certbot_auto_renew
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue