aboutsummaryrefslogtreecommitdiffstats
path: root/roles/web/tasks/main.yml
blob: c1d6b179c92e814b96aa98cee630af101189b08f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
---
- name: install package
  pkgng:
    name: "{{ item }}"
    state: present
  with_items:
    - nginx
    - acme-client

- name: (local) ssl/tls - check dhparam existence
  become: false
  stat:
    path: "{{ playbook_dir }}/ssl/dhparam4096.pem"
  delegate_to: localhost
  register: stat_result

- name: (local) ssl/tls - generate dhparam (4096 bit)
  become: false
  command: >
    openssl dhparam
    -out "{{ playbook_dir }}/ssl/dhparam4096.pem" 4096
  delegate_to: localhost
  when: not stat_result.stat.exists

- name: ssl/tls - copy dhparam
  copy:
    src: "{{ playbook_dir }}/ssl/dhparam4096.pem"
    dest: /usr/local/etc/ssl/dhparam4096.pem
    mode: 0444

- name: nginx - copy conf.d/ config directory
  copy:
    src: conf.d/  # trailing '/' -> directory contents
    dest: /usr/local/etc/nginx/conf.d/

- name: nginx - create sites/ directory
  file:
    path: /usr/local/etc/nginx/sites
    state: directory

- name: nginx - generate sites
  include_tasks: nginx-gensites.yml

- name: nginx - copy nginx.conf
  copy:
    src: nginx.conf
    dest: /usr/local/etc/nginx/nginx.conf
    # XXX: Validation runs aganist a temporary file, thus nginx fails to
    #      include other config files!
    #validate: "nginx -t -c %s"
  notify: reload-nginx

- name: nginx - check configuration
  command: nginx -t

- name: nginx - enable and start
  command: rcenable nginx

- name: newsyslog - nginx log rotation
  blockinfile:
    path: /etc/newsyslog.conf
    marker: '# {mark} ANSIBLE MANAGED - nginx'
    block: |
      /var/log/nginx/access.log		644  7	   *	@T00  Z    /var/run/nginx.pid
      /var/log/nginx/error.log		644  7	   *	@T00  Z    /var/run/nginx.pid

- name: acme - copy scripts
  copy:
    src: "{{ item }}"
    dest: /usr/local/etc/acme/{{ item | basename }}
    mode: 0755
  with_items:
    - acme-client.sh
    - deploy.sh

- name: (local) acme - check account private key existence
  become: false
  stat:
    path: "{{ playbook_dir }}/private/acme/privkey.pem"
  delegate_to: localhost
  register: stat_result

- name: (local) acme - generate account private key (4096 bit)
  become: false
  command: >
    openssl genrsa
    -out "{{ playbook_dir }}/private/acme/privkey.pem" 4096
  delegate_to: localhost
  when: not stat_result.stat.exists

- name: acme - copy account private key
  copy:
    src: "{{ playbook_dir }}/private/acme/privkey.pem"
    dest: /usr/local/etc/acme/privkey.pem
    mode: 0400

- name: acme - create domain private directory
  file:
    path: /usr/local/etc/ssl/acme/private/
    state: directory
    mode: 0700

# Credit: https://shasawas.wordpress.com/2016/05/23/how-to-loop-over-a-set-of-tasks-in-ansible/
- name: acme - generate and copy domain private keys
  include_tasks: acme-domainkey.yml domain={{ item.name }}
  with_items: "{{ domains }}"

- name: acme - generate domains.txt
  template:
    src: domains.txt.j2
    dest: /usr/local/etc/acme/domains.txt

- name: acme - create challenge directory
  file:
    path: /usr/local/www/acme/.well-known/acme-challenge
    state: directory
    group: www
    recurse: true

- name: nginx - force reload
  command: rcreload nginx

- name: acme - request domain certificates
  command: sh /usr/local/etc/acme/acme-client.sh -e

- name: acme - setup periodic tasks for cert renewal
  blockinfile:
    path: /etc/periodic.conf
    marker: "# {mark} ANSIBLE MANAGED - acme"
    block: |
      # Auto renew certificates with acme-client
      weekly_acme_client_enable="YES"
      weekly_acme_client_renewscript="/usr/local/etc/acme/acme-client.sh"
      weekly_acme_client_deployscript="/usr/local/etc/acme/deploy.sh"

- name: nginx - re-generate sites
  include_tasks: nginx-gensites.yml
  notify: reload-nginx
  tags: sites