aboutsummaryrefslogtreecommitdiffstats
path: root/roles/web/tasks/main.yml
blob: e3537ed6888fa2898d1391e73e20c1b04fedc189 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
---
- name: install package
  pkgng:
    name: "{{ item }}"
    state: present
  with_items:
    - nginx
    - acme-client

- name: (local) ssl/tls - check dhparam existence
  become: false
  stat:
    path: "{{ playbook_dir }}/ssl/dhparam4096.pem"
  delegate_to: localhost
  register: stat_result

- name: (local) ssl/tls - generate dhparam (4096 bit)
  become: false
  command: >
    openssl dhparam
    -out "{{ playbook_dir }}/ssl/dhparam4096.pem" 4096
  delegate_to: localhost
  when: not stat_result.stat.exists

- name: ssl/tls - copy dhparam
  copy:
    src: "{{ playbook_dir }}/ssl/dhparam4096.pem"
    dest: /usr/local/etc/ssl/dhparam4096.pem
    mode: 0444

- name: nginx - copy conf.d/ config directory
  copy:
    src: nginx/conf.d/  # trailing '/' -> directory contents
    dest: /usr/local/etc/nginx/conf.d/

- name: nginx - create sites/ directory
  file:
    path: /usr/local/etc/nginx/sites
    state: directory

- name: nginx - generate sites
  include_tasks: nginx-gensites.yml

- name: nginx - copy nginx.conf
  copy:
    src: nginx/nginx.conf
    dest: /usr/local/etc/nginx/nginx.conf
    # XXX: Validation runs aganist a temporary file, thus nginx fails to
    #      include other config files!
    #validate: "nginx -t -c %s"
  notify: reload-nginx

- name: nginx - check configuration
  command: nginx -t

- name: nginx - enable and start
  command: rcenable nginx

- name: newsyslog - nginx log rotation
  blockinfile:
    path: /etc/newsyslog.conf
    marker: '# {mark} ANSIBLE MANAGED - nginx'
    block: |
      /var/log/nginx/access.log		644  7	   *	@T00  Z    /var/run/nginx.pid
      /var/log/nginx/error.log		644  7	   *	@T00  Z    /var/run/nginx.pid

- name: acme - copy scripts
  copy:
    src: "{{ item }}"
    dest: /usr/local/etc/acme/{{ item | basename }}
    mode: 0755
  with_fileglob:
    - "acme/*.sh"
  tags: acme

- name: acme - copy deployment scripts
  copy:
    src: acme/deploy.d/  # note the trailing '/'
    dest: /usr/local/etc/acme/deploy.d/
  tags: acme

- name: (local) acme - check account private key existence
  become: false
  stat:
    path: "{{ playbook_dir }}/private/acme/privkey.pem"
  delegate_to: localhost
  register: stat_result
  tags: acme

- name: (local) acme - generate account private key (4096 bit)
  become: false
  command: >
    openssl genrsa
    -out "{{ playbook_dir }}/private/acme/privkey.pem" 4096
  delegate_to: localhost
  when: not stat_result.stat.exists
  tags: acme

- name: acme - copy account private key
  copy:
    src: "{{ playbook_dir }}/private/acme/privkey.pem"
    dest: /usr/local/etc/acme/privkey.pem
    mode: 0400
  tags: acme

- name: acme - create domain private directory
  file:
    path: /usr/local/etc/ssl/acme/private/
    state: directory
    mode: 0700
  tags: acme

# Credit: https://shasawas.wordpress.com/2016/05/23/how-to-loop-over-a-set-of-tasks-in-ansible/
- name: acme - generate and copy domain private keys
  include_tasks: acme-domainkey.yml domain={{ item.name }}
  with_items: "{{ domains }}"
  tags:
    - acme
    - acme-renew

- name: acme - generate domains.txt
  template:
    src: domains.txt.j2
    dest: /usr/local/etc/acme/domains.txt
  tags:
    - acme
    - acme-renew

- name: acme - create challenge directory
  file:
    path: /usr/local/www/acme/.well-known/acme-challenge
    state: directory
    group: www
    recurse: true
  tags: acme

- name: nginx - force reload
  command: rcreload nginx
  tags:
    - acme
    - acme-renew

- name: acme - request domain certificates
  command: sh /usr/local/etc/acme/acme-client.sh -e
  notify: deploy-acme
  tags:
    - acme
    - acme-renew

- name: acme - setup periodic tasks for cert renewal
  blockinfile:
    path: /etc/periodic.conf
    marker: "# {mark} ANSIBLE MANAGED - acme"
    block: |
      # Auto renew certificates with acme-client
      weekly_acme_client_enable="YES"
      weekly_acme_client_renewscript="/usr/local/etc/acme/acme-client.sh"
      weekly_acme_client_deployscript="/usr/local/etc/acme/deploy.sh"

- name: nginx - re-generate sites
  include_tasks: nginx-gensites.yml
  tags: sites