blob: c1d6b179c92e814b96aa98cee630af101189b08f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
---
- name: install package
pkgng:
name: "{{ item }}"
state: present
with_items:
- nginx
- acme-client
- name: (local) ssl/tls - check dhparam existence
become: false
stat:
path: "{{ playbook_dir }}/ssl/dhparam4096.pem"
delegate_to: localhost
register: stat_result
- name: (local) ssl/tls - generate dhparam (4096 bit)
become: false
command: >
openssl dhparam
-out "{{ playbook_dir }}/ssl/dhparam4096.pem" 4096
delegate_to: localhost
when: not stat_result.stat.exists
- name: ssl/tls - copy dhparam
copy:
src: "{{ playbook_dir }}/ssl/dhparam4096.pem"
dest: /usr/local/etc/ssl/dhparam4096.pem
mode: 0444
- name: nginx - copy conf.d/ config directory
copy:
src: conf.d/ # trailing '/' -> directory contents
dest: /usr/local/etc/nginx/conf.d/
- name: nginx - create sites/ directory
file:
path: /usr/local/etc/nginx/sites
state: directory
- name: nginx - generate sites
include_tasks: nginx-gensites.yml
- name: nginx - copy nginx.conf
copy:
src: nginx.conf
dest: /usr/local/etc/nginx/nginx.conf
# XXX: Validation runs aganist a temporary file, thus nginx fails to
# include other config files!
#validate: "nginx -t -c %s"
notify: reload-nginx
- name: nginx - check configuration
command: nginx -t
- name: nginx - enable and start
command: rcenable nginx
- name: newsyslog - nginx log rotation
blockinfile:
path: /etc/newsyslog.conf
marker: '# {mark} ANSIBLE MANAGED - nginx'
block: |
/var/log/nginx/access.log 644 7 * @T00 Z /var/run/nginx.pid
/var/log/nginx/error.log 644 7 * @T00 Z /var/run/nginx.pid
- name: acme - copy scripts
copy:
src: "{{ item }}"
dest: /usr/local/etc/acme/{{ item | basename }}
mode: 0755
with_items:
- acme-client.sh
- deploy.sh
- name: (local) acme - check account private key existence
become: false
stat:
path: "{{ playbook_dir }}/private/acme/privkey.pem"
delegate_to: localhost
register: stat_result
- name: (local) acme - generate account private key (4096 bit)
become: false
command: >
openssl genrsa
-out "{{ playbook_dir }}/private/acme/privkey.pem" 4096
delegate_to: localhost
when: not stat_result.stat.exists
- name: acme - copy account private key
copy:
src: "{{ playbook_dir }}/private/acme/privkey.pem"
dest: /usr/local/etc/acme/privkey.pem
mode: 0400
- name: acme - create domain private directory
file:
path: /usr/local/etc/ssl/acme/private/
state: directory
mode: 0700
# Credit: https://shasawas.wordpress.com/2016/05/23/how-to-loop-over-a-set-of-tasks-in-ansible/
- name: acme - generate and copy domain private keys
include_tasks: acme-domainkey.yml domain={{ item.name }}
with_items: "{{ domains }}"
- name: acme - generate domains.txt
template:
src: domains.txt.j2
dest: /usr/local/etc/acme/domains.txt
- name: acme - create challenge directory
file:
path: /usr/local/www/acme/.well-known/acme-challenge
state: directory
group: www
recurse: true
- name: nginx - force reload
command: rcreload nginx
- name: acme - request domain certificates
command: sh /usr/local/etc/acme/acme-client.sh -e
- name: acme - setup periodic tasks for cert renewal
blockinfile:
path: /etc/periodic.conf
marker: "# {mark} ANSIBLE MANAGED - acme"
block: |
# Auto renew certificates with acme-client
weekly_acme_client_enable="YES"
weekly_acme_client_renewscript="/usr/local/etc/acme/acme-client.sh"
weekly_acme_client_deployscript="/usr/local/etc/acme/deploy.sh"
- name: nginx - re-generate sites
include_tasks: nginx-gensites.yml
notify: reload-nginx
tags: sites
|
