move mox and ln from make to ansible

1 files changed, 26 insertions, 2 deletions

diff --git a/ansible/roles/tls/tasks/main.yml b/ansible/roles/tls/tasks/main.yml
index d26435b..e758fc5 100644
--- a/ansible/roles/tls/tasks/main.yml
+++ b/ansible/roles/tls/tasks/main.yml
@@ -29,7 +29,7 @@
     certbot renew --non-interactive
 
 - name: Install missing TLS certificates
-  loop: "{{ subdomains }}"
+  loop: "{{ subdomains | map(attribute='name') }}"
   when: not ( ( item ~ ".joeac.net" ) in ansible_local.certbot.certificates )
   ansible.builtin.shell:
     certbot certonly \
@@ -38,9 +38,33 @@
      	--domain {% if item == "@" %} joeac.net {% else %} {{ item }}.joeac.net {% endif %} \
      	--non-interactive
 
+- name: Add joeac.net group
+  ansible.builtin.group:
+    name: joeac.net
+
+- name: Add tls group
+  ansible.builtin.group:
+    name: tls
+
+- name: Add joeac.net user
+  ansible.builtin.user:
+    name: joeac.net
+    group: joeac.net
+    groups:
+      - tls
+    append: false
+
+- name: Give ownership of /etc/letsencrypt to joeac.net:tls
+  ansible.builtin.file:
+    path: /etc/letsencrypt
+    owner: joeac.net
+    group: tls
+    mode: g+rwx
+    recurse: true
+
 - name: Install daily crontab to renew TLS certificates
   ansible.builtin.cron:
     special_time: daily
     name: daily crontab to renew all TLS certificates near to expiry
     job:
-      certbot renew --non-interactive
+      certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt