blob: f637ff54a80c9ac7f9df7897ac0ef2ca59740383 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
- name: Create Ansible facts directory
ansible.builtin.file:
path: /etc/ansible/facts.d
state: directory
recurse: true
- name: Install certbot facts script
register: certbot_fact_script
ansible.builtin.copy:
src: certbot.fact
dest: /etc/ansible/facts.d/certbot.fact
mode: "775"
- name: Re-gather custom facts
when: certbot_fact_script is changed
ansible.builtin.setup:
filter: ansible_local
- name: Install certbot and certbot-dns-ovh
community.general.apk:
name:
- certbot
- certbot-dns-ovh
- name: Renew all TLS certificates that are near expiry
when: ( ansible_local.certbot.invalid_certificates | length ) > 0
ansible.builtin.shell:
certbot renew --non-interactive
- name: Install OVH DNS credentials
ansible.builtin.copy:
src: ovh-dns-credentials.ini
dest: /etc/ovh-dns-credentials.ini
mode: "400"
- name: Install missing TLS certificates
loop: "{{ subdomains }}"
when: not ( ( item.name ~ ".joeac.net" ) in ansible_local.certbot.certificates )
ansible.builtin.shell:
certbot certonly \
--dns-ovh \
--dns-ovh-credentials /etc/ovh-dns-credentials.ini \
--cert-name {{ item.name }}.joeac.net \
--domain {{ item.full_domain }} \
--non-interactive
- name: Add joeac.net group
ansible.builtin.group:
name: joeac.net
- name: Add tls group
ansible.builtin.group:
name: tls
- name: Add joeac.net user
ansible.builtin.user:
name: joeac.net
group: joeac.net
groups:
- tls
append: false
- name: Give ownership of /etc/letsencrypt to joeac.net:tls
ansible.builtin.file:
path: /etc/letsencrypt
owner: joeac.net
group: tls
mode: g+rwx
recurse: true
- name: Install daily crontab to renew TLS certificates
ansible.builtin.cron:
special_time: daily
name: daily crontab to renew all TLS certificates near to expiry
job:
certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt
|
