diff options
Diffstat (limited to 'ansible/roles/tls')
| -rw-r--r-- | ansible/roles/tls/files/ovh-dns-credentials.ini | 14 | ||||
| -rw-r--r-- | ansible/roles/tls/tasks/main.yml | 14 |
2 files changed, 24 insertions, 4 deletions
diff --git a/ansible/roles/tls/files/ovh-dns-credentials.ini b/ansible/roles/tls/files/ovh-dns-credentials.ini new file mode 100644 index 0000000..210a403 --- /dev/null +++ b/ansible/roles/tls/files/ovh-dns-credentials.ini @@ -0,0 +1,14 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +37333731336135353732336462623564633235633561336130376361646266363930626230616230 +6261356563343235353865663836643830616561613132320a643933303936343361336634313363 +38646163363939333662393666373335346565666236363163366137616137343734303531346531 +6135343839646662660a383339303664383235656431303333623661343638663631646131393164 +34666135616533656561626131323631303637663062363266663934666634386565656339663331 +65663135303661636564386266383333326536303161636230363461313131643664663739616434 +63366335623935656337313735623134323530393636373639633863346265343831363130623861 +30316233336335653233333633333461646364656435333936613733393835343931346536366430 +31333634346362346234613137623133633731353432363037306235393131356665323761643835 +37333562393362333033313932353363356536626565373939333230303435326635636639343262 +30366466636362653536613635653034313765646238383737386636306134633135326365333065 +33656335316330326439313235323862393134663062643562636434343839323232356661656633 +39653361313235396436366564366131313731346436346236356534363937303337 diff --git a/ansible/roles/tls/tasks/main.yml b/ansible/roles/tls/tasks/main.yml index b9b76b1..f637ff5 100644 --- a/ansible/roles/tls/tasks/main.yml +++ b/ansible/roles/tls/tasks/main.yml @@ -16,24 +16,30 @@ ansible.builtin.setup: filter: ansible_local -- name: Install certbot and nginx +- name: Install certbot and certbot-dns-ovh community.general.apk: name: - certbot - - nginx - state: present + - certbot-dns-ovh - name: Renew all TLS certificates that are near expiry when: ( ansible_local.certbot.invalid_certificates | length ) > 0 ansible.builtin.shell: certbot renew --non-interactive +- name: Install OVH DNS credentials + ansible.builtin.copy: + src: ovh-dns-credentials.ini + dest: /etc/ovh-dns-credentials.ini + mode: "400" + - name: Install missing TLS certificates loop: "{{ subdomains }}" when: not ( ( item.name ~ ".joeac.net" ) in ansible_local.certbot.certificates ) ansible.builtin.shell: certbot certonly \ - --nginx \ + --dns-ovh \ + --dns-ovh-credentials /etc/ovh-dns-credentials.ini \ --cert-name {{ item.name }}.joeac.net \ --domain {{ item.full_domain }} \ --non-interactive |