From 9f2ebc2cce3af0e685677c23f2098c115e034adf Mon Sep 17 00:00:00 2001
From: Joe Carstairs <me@joeac.net>
Date: Thu, 13 Aug 2026 16:35:47 +0100
Subject: move ansible/ dir to root

---
 roles/tls/files/certbot.fact            | 35 +++++++++++++++
 roles/tls/files/ovh-dns-credentials.ini | 14 ++++++
 roles/tls/tasks/main.yml                | 76 +++++++++++++++++++++++++++++++++
 3 files changed, 125 insertions(+)
 create mode 100644 roles/tls/files/certbot.fact
 create mode 100644 roles/tls/files/ovh-dns-credentials.ini
 create mode 100644 roles/tls/tasks/main.yml

(limited to 'roles/tls')

diff --git a/roles/tls/files/certbot.fact b/roles/tls/files/certbot.fact
new file mode 100644
index 0000000..baa43bb
--- /dev/null
+++ b/roles/tls/files/certbot.fact
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+certbot_certificates_output="$(certbot certificates 2>/dev/null)"
+certificates="$(echo "$certbot_certificates_output" | grep "Certificate Name:" | sed "s/.*Certificate Name: *//g")"
+all_certificates=""
+valid_certificates=""
+invalid_certificates=""
+for certificate in $certificates
+do
+  all_certificates="$all_certificates $certificate"
+  if [ -n "$(echo "$certbot_certificates_output" | grep "Expiry Date:" | grep -E "VALID:")" ]
+  then
+    valid_certificates="$valid_certificates $certificate"
+  else
+    invalid_certificates="$invalid_certificates $certificate"
+  fi
+done
+
+jsonify()
+{
+  if [ -z "$1" ]
+  then
+    echo "[]"
+  else
+    echo "[\"$1\"]" | sed "s/ /\", \"/g"
+  fi
+}
+
+cat <<EOF
+{
+  "certificates": $(jsonify "$all_certificates"),
+  "invalid_certificates": $(jsonify "$invalid_certificates"),
+  "valid_certificates": $(jsonify "$valid_certificates")
+}
+EOF
diff --git a/roles/tls/files/ovh-dns-credentials.ini b/roles/tls/files/ovh-dns-credentials.ini
new file mode 100644
index 0000000..210a403
--- /dev/null
+++ b/roles/tls/files/ovh-dns-credentials.ini
@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.2;AES256;ansible
+37333731336135353732336462623564633235633561336130376361646266363930626230616230
+6261356563343235353865663836643830616561613132320a643933303936343361336634313363
+38646163363939333662393666373335346565666236363163366137616137343734303531346531
+6135343839646662660a383339303664383235656431303333623661343638663631646131393164
+34666135616533656561626131323631303637663062363266663934666634386565656339663331
+65663135303661636564386266383333326536303161636230363461313131643664663739616434
+63366335623935656337313735623134323530393636373639633863346265343831363130623861
+30316233336335653233333633333461646364656435333936613733393835343931346536366430
+31333634346362346234613137623133633731353432363037306235393131356665323761643835
+37333562393362333033313932353363356536626565373939333230303435326635636639343262
+30366466636362653536613635653034313765646238383737386636306134633135326365333065
+33656335316330326439313235323862393134663062643562636434343839323232356661656633
+39653361313235396436366564366131313731346436346236356534363937303337
diff --git a/roles/tls/tasks/main.yml b/roles/tls/tasks/main.yml
new file mode 100644
index 0000000..f637ff5
--- /dev/null
+++ b/roles/tls/tasks/main.yml
@@ -0,0 +1,76 @@
+- name: Create Ansible facts directory
+  ansible.builtin.file:
+    path: /etc/ansible/facts.d
+    state: directory
+    recurse: true
+
+- name: Install certbot facts script
+  register: certbot_fact_script
+  ansible.builtin.copy:
+    src: certbot.fact
+    dest: /etc/ansible/facts.d/certbot.fact
+    mode: "775"
+
+- name: Re-gather custom facts
+  when: certbot_fact_script is changed
+  ansible.builtin.setup:
+    filter: ansible_local
+
+- name: Install certbot and certbot-dns-ovh
+  community.general.apk:
+    name:
+      - certbot
+      - certbot-dns-ovh
+
+- name: Renew all TLS certificates that are near expiry
+  when: ( ansible_local.certbot.invalid_certificates | length ) > 0
+  ansible.builtin.shell:
+    certbot renew --non-interactive
+
+- name: Install OVH DNS credentials
+  ansible.builtin.copy:
+    src: ovh-dns-credentials.ini
+    dest: /etc/ovh-dns-credentials.ini
+    mode: "400"
+
+- name: Install missing TLS certificates
+  loop: "{{ subdomains }}"
+  when: not ( ( item.name ~ ".joeac.net" ) in ansible_local.certbot.certificates )
+  ansible.builtin.shell:
+    certbot certonly \
+     	--dns-ovh \
+      --dns-ovh-credentials /etc/ovh-dns-credentials.ini \
+     	--cert-name {{ item.name }}.joeac.net \
+     	--domain {{ item.full_domain }} \
+     	--non-interactive
+
+- name: Add joeac.net group
+  ansible.builtin.group:
+    name: joeac.net
+
+- name: Add tls group
+  ansible.builtin.group:
+    name: tls
+
+- name: Add joeac.net user
+  ansible.builtin.user:
+    name: joeac.net
+    group: joeac.net
+    groups:
+      - tls
+    append: false
+
+- name: Give ownership of /etc/letsencrypt to joeac.net:tls
+  ansible.builtin.file:
+    path: /etc/letsencrypt
+    owner: joeac.net
+    group: tls
+    mode: g+rwx
+    recurse: true
+
+- name: Install daily crontab to renew TLS certificates
+  ansible.builtin.cron:
+    special_time: daily
+    name: daily crontab to renew all TLS certificates near to expiry
+    job:
+      certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt
-- 
cgit v1.2.3