move ansible/ dir to root

1 files changed, 76 insertions, 0 deletions

diff --git a/roles/tls/tasks/main.yml b/roles/tls/tasks/main.yml
new file mode 100644
index 0000000..f637ff5
--- /dev/null
+++ b/roles/tls/tasks/main.yml
@@ -0,0 +1,76 @@
+- name: Create Ansible facts directory
+  ansible.builtin.file:
+    path: /etc/ansible/facts.d
+    state: directory
+    recurse: true
+
+- name: Install certbot facts script
+  register: certbot_fact_script
+  ansible.builtin.copy:
+    src: certbot.fact
+    dest: /etc/ansible/facts.d/certbot.fact
+    mode: "775"
+
+- name: Re-gather custom facts
+  when: certbot_fact_script is changed
+  ansible.builtin.setup:
+    filter: ansible_local
+
+- name: Install certbot and certbot-dns-ovh
+  community.general.apk:
+    name:
+      - certbot
+      - certbot-dns-ovh
+
+- name: Renew all TLS certificates that are near expiry
+  when: ( ansible_local.certbot.invalid_certificates | length ) > 0
+  ansible.builtin.shell:
+    certbot renew --non-interactive
+
+- name: Install OVH DNS credentials
+  ansible.builtin.copy:
+    src: ovh-dns-credentials.ini
+    dest: /etc/ovh-dns-credentials.ini
+    mode: "400"
+
+- name: Install missing TLS certificates
+  loop: "{{ subdomains }}"
+  when: not ( ( item.name ~ ".joeac.net" ) in ansible_local.certbot.certificates )
+  ansible.builtin.shell:
+    certbot certonly \
+     	--dns-ovh \
+      --dns-ovh-credentials /etc/ovh-dns-credentials.ini \
+     	--cert-name {{ item.name }}.joeac.net \
+     	--domain {{ item.full_domain }} \
+     	--non-interactive
+
+- name: Add joeac.net group
+  ansible.builtin.group:
+    name: joeac.net
+
+- name: Add tls group
+  ansible.builtin.group:
+    name: tls
+
+- name: Add joeac.net user
+  ansible.builtin.user:
+    name: joeac.net
+    group: joeac.net
+    groups:
+      - tls
+    append: false
+
+- name: Give ownership of /etc/letsencrypt to joeac.net:tls
+  ansible.builtin.file:
+    path: /etc/letsencrypt
+    owner: joeac.net
+    group: tls
+    mode: g+rwx
+    recurse: true
+
+- name: Install daily crontab to renew TLS certificates
+  ansible.builtin.cron:
+    special_time: daily
+    name: daily crontab to renew all TLS certificates near to expiry
+    job:
+      certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt