blob: 7c7b88f151b0625f35079537a708533bb22d0fc9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
---
- name: install package
pkgng:
name:
- nginx
- acme-client
state: present
- name: (local) ssl/tls - check dhparam existence
become: false
stat:
path: "{{ playbook_dir }}/private/ssl/dhparam4096.pem"
delegate_to: localhost
register: stat_result
- name: (local) ssl/tls - generate dhparam (4096 bit)
become: false
command: >
openssl dhparam
-out "{{ playbook_dir }}/private/ssl/dhparam4096.pem" 4096
delegate_to: localhost
when: not stat_result.stat.exists
- name: ssl/tls - copy dhparam
copy:
src: "{{ playbook_dir }}/private/ssl/dhparam4096.pem"
dest: /usr/local/etc/ssl/dhparam4096.pem
mode: 0444
- name: nginx - copy conf.d/ config directory
copy:
src: nginx/conf.d/ # trailing '/' -> directory contents
dest: /usr/local/etc/nginx/conf.d/
- name: nginx - create sites/ directory
file:
path: /usr/local/etc/nginx/sites
state: directory
- name: nginx - generate basic site for ACME
template:
src: sites/00-acme-httpredirect.conf.j2
dest: /usr/local/etc/nginx/sites/00-acme-httpredirect.conf
- name: nginx - copy nginx.conf
copy:
src: nginx/nginx.conf
dest: /usr/local/etc/nginx/nginx.conf
# XXX: Validation runs aganist a temporary file, thus nginx fails to
# include other config files!
#validate: "nginx -t -c %s"
notify: reload-nginx
- name: nginx - check configuration
command: nginx -t
- name: nginx - enable and start
command: rcenable nginx
- name: newsyslog - nginx log rotation
blockinfile:
path: /etc/newsyslog.conf
marker: '# {mark} ANSIBLE MANAGED - nginx'
block: |
/var/log/nginx/access.log 644 7 * @T00 Z /var/run/nginx.pid
/var/log/nginx/error.log 644 7 * @T00 Z /var/run/nginx.pid
- name: acme - copy scripts
copy:
src: "{{ item }}"
dest: /usr/local/etc/acme/{{ item | basename }}
mode: 0755
with_fileglob:
- "acme/*.sh"
tags: acme
- name: acme - copy deployment scripts
copy:
src: acme/deploy.d/ # note the trailing '/'
dest: /usr/local/etc/acme/deploy.d/
tags: acme
- name: (local) acme - check account private key existence
become: false
stat:
path: "{{ playbook_dir }}/private/acme/privkey.pem"
delegate_to: localhost
register: stat_result
tags: acme
- name: (local) acme - generate account private key (4096 bit)
become: false
command: >
openssl genrsa
-out "{{ playbook_dir }}/private/acme/privkey.pem" 4096
delegate_to: localhost
when: not stat_result.stat.exists
tags: acme
- name: acme - copy account private key
copy:
src: "{{ playbook_dir }}/private/acme/privkey.pem"
dest: /usr/local/etc/acme/privkey.pem
mode: 0400
tags: acme
- name: acme - create domain private directory
file:
path: /usr/local/etc/ssl/acme/private/
state: directory
mode: 0700
tags: acme
# Credit: https://shasawas.wordpress.com/2016/05/23/how-to-loop-over-a-set-of-tasks-in-ansible/
- block:
- name: acme - generate and copy domain private keys
include_tasks: acme-domainkey.yml
vars:
domain: "{{ item.name }}"
with_items: "{{ domains }}"
tags:
- acme
- acme-renew
- name: acme - generate domains.txt
template:
src: domains.txt.j2
dest: /usr/local/etc/acme/domains.txt
tags:
- acme
- acme-renew
- name: acme - create challenge directory
file:
path: /usr/local/www/acme/.well-known/acme-challenge
state: directory
group: www
recurse: true
tags: acme
- name: nginx - force reload
command: rcreload nginx
tags:
- acme
- acme-renew
- name: acme - request domain certificates
command: sh /usr/local/etc/acme/acme-client.sh -e
notify: deploy-acme
tags:
- acme
- acme-renew
- name: acme - setup periodic tasks for cert renewal
blockinfile:
path: /etc/periodic.conf
marker: "# {mark} ANSIBLE MANAGED - acme"
block: |
# Auto renew certificates with acme-client
weekly_acme_client_enable="YES"
weekly_acme_client_renewscript="/usr/local/etc/acme/acme-client.sh"
weekly_acme_client_deployscript="/usr/local/etc/acme/deploy.sh"
- block:
- name: nginx - re-generate sites
include_tasks: nginx-gensites.yml
tags: sites
|
