diff options
| -rw-r--r-- | Makefile | 13 | ||||
| -rw-r--r-- | ansible/playbook.yml | 3 | ||||
| -rw-r--r-- | ansible/requirements.yml | 3 | ||||
| -rw-r--r-- | ansible/roles/tls/files/certbot.fact | 35 | ||||
| -rw-r--r-- | ansible/roles/tls/tasks/main.yml | 46 | ||||
| -rw-r--r-- | make/tls.mk | 89 |
6 files changed, 92 insertions, 97 deletions
@@ -17,19 +17,19 @@ endef define install_module_rule = .PHONY: install_$(module) -install_$(module): install_openrc_$(module) $(if $(SUBDOMAIN_$(module)),install_tls_$(SUBDOMAIN_$(module))) $(install_submake_file) +install_$(module): install_openrc_$(module) $(install_submake_file) $(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) install) endef define reinstall_module_rule = .PHONY: reinstall_$(module) -reinstall_$(module): reinstall_openrc_$(module) $(if $(SUBDOMAIN_$(module)),reinstall_tls_$(SUBDOMAIN_$(module))) $(install_submake_file) +reinstall_$(module): reinstall_openrc_$(module) $(install_submake_file) $(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) reinstall) endef define uninstall_module_rule = .PHONY: uninstall_$(module) -uninstall_$(module): uninstall_openrc_$(module) $(if $(SUBDOMAIN_$(module)),install_tls_$(SUBDOMAIN_$(module))) +uninstall_$(module): uninstall_openrc_$(module) $(if $(install_submake_file),\ $(MAKE) --makefile=$(notdir $(install_submake_file)) --directory $(dir $(install_submake_file)) uninstall ) @@ -42,13 +42,13 @@ $(foreach module,$(ALL_MODULES),$(eval $(call make_module_rule))) $(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule))) .PHONY: install -install: install_tls install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab +install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab .PHONY: reinstall -reinstall: reinstall_tls reinstall_nginx $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab +reinstall: reinstall_nginx $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab .PHONY: uninstall -uninstall: uninstall_nginx uninstall_tls uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab +uninstall: uninstall_nginx uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab $(foreach module,$(ALL_MODULES),$(eval $(install_module_rule))) $(foreach module,$(ALL_MODULES),$(eval $(reinstall_module_rule))) @@ -62,4 +62,3 @@ include make/container.mk include make/openrc.mk include make/nginx.mk include make/crontab.mk -include make/tls.mk diff --git a/ansible/playbook.yml b/ansible/playbook.yml index d91eaa4..84e8052 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -1,7 +1,8 @@ -- name: Install dyndns +- name: Install dyndns and TLS hosts: blade-canongate become: true roles: - dyndns + - tls vars_files: - common.yml diff --git a/ansible/requirements.yml b/ansible/requirements.yml new file mode 100644 index 0000000..8eb5526 --- /dev/null +++ b/ansible/requirements.yml @@ -0,0 +1,3 @@ +collections: + - name: community.general + version: 13.2.0 diff --git a/ansible/roles/tls/files/certbot.fact b/ansible/roles/tls/files/certbot.fact new file mode 100644 index 0000000..baa43bb --- /dev/null +++ b/ansible/roles/tls/files/certbot.fact @@ -0,0 +1,35 @@ +#!/bin/sh + +certbot_certificates_output="$(certbot certificates 2>/dev/null)" +certificates="$(echo "$certbot_certificates_output" | grep "Certificate Name:" | sed "s/.*Certificate Name: *//g")" +all_certificates="" +valid_certificates="" +invalid_certificates="" +for certificate in $certificates +do + all_certificates="$all_certificates $certificate" + if [ -n "$(echo "$certbot_certificates_output" | grep "Expiry Date:" | grep -E "VALID:")" ] + then + valid_certificates="$valid_certificates $certificate" + else + invalid_certificates="$invalid_certificates $certificate" + fi +done + +jsonify() +{ + if [ -z "$1" ] + then + echo "[]" + else + echo "[\"$1\"]" | sed "s/ /\", \"/g" + fi +} + +cat <<EOF +{ + "certificates": $(jsonify "$all_certificates"), + "invalid_certificates": $(jsonify "$invalid_certificates"), + "valid_certificates": $(jsonify "$valid_certificates") +} +EOF diff --git a/ansible/roles/tls/tasks/main.yml b/ansible/roles/tls/tasks/main.yml new file mode 100644 index 0000000..d26435b --- /dev/null +++ b/ansible/roles/tls/tasks/main.yml @@ -0,0 +1,46 @@ +- name: Create Ansible facts directory + ansible.builtin.file: + path: /etc/ansible/facts.d + state: directory + recurse: true + +- name: Install certbot facts script + register: certbot_fact_script + ansible.builtin.copy: + src: certbot.fact + dest: /etc/ansible/facts.d/certbot.fact + mode: "775" + +- name: Re-gather custom facts + when: certbot_fact_script is changed + ansible.builtin.setup: + filter: ansible_local + +- name: Install certbot and nginx + community.general.apk: + name: + - certbot + - nginx + state: present + +- name: Renew all TLS certificates that are near expiry + when: ( ansible_local.certbot.invalid_certificates | length ) > 0 + ansible.builtin.shell: + certbot renew --non-interactive + +- name: Install missing TLS certificates + loop: "{{ subdomains }}" + when: not ( ( item ~ ".joeac.net" ) in ansible_local.certbot.certificates ) + ansible.builtin.shell: + certbot certonly \ + --nginx \ + --cert-name {{ item }}.joeac.net \ + --domain {% if item == "@" %} joeac.net {% else %} {{ item }}.joeac.net {% endif %} \ + --non-interactive + +- name: Install daily crontab to renew TLS certificates + ansible.builtin.cron: + special_time: daily + name: daily crontab to renew all TLS certificates near to expiry + job: + certbot renew --non-interactive diff --git a/make/tls.mk b/make/tls.mk deleted file mode 100644 index fcbb250..0000000 --- a/make/tls.mk +++ /dev/null @@ -1,89 +0,0 @@ -installed_tls_crontabs = $(wildcard /etc/periodic/daily/tls-*.joeac.net) -installed_tls_crontab_subdomains = $(installed_tls_crontabs:/etc/periodic/daily/tls-%.joeac.net=%) -tls_crontab_subdomains_to_remove = $(filter-out $(SUBDOMAINS),$(installed_tls_crontab_subdomains)) -tls_crontabs_to_remove = $(tls_crontab_subdomains_to_remove:%=/etc/periodic/daily/tls-%.joeac.net) - -installed_tls_certs = $(wildcard /etc/letsencrypt/live/*.joeac.net) -installed_tls_cert_subdomains = $(installed_tls_certs:/etc/letsencrypt/live/%.joeac.net=%) -tls_cert_subdomains_to_delete = $(filter-out $(SUBDOMAINS),$(installed_tls_cert_subdomains)) - -tls_crontab = /etc/periodic/daily/tls-$(subdomain).joeac.net -tls_cert = /etc/letsencrypt/live/$(subdomain).joeac.net/fullchain.pem - -define install_tls_subdomain_rule = -.PHONY: install_tls_$(subdomain) -install_tls_$(subdomain): $(tls_crontab) $(tls_cert) -endef - -define reinstall_tls_subdomain_rule = -.PHONY: reinstall_tls_$(subdomain) -reinstall_tls_$(subdomain): $(tls_crontab) renew_$(tls_cert) -endef - -define uninstall_tls_subdomain_rule = -.PHONY: uninstall_tls_$(subdomain) -uninstall_tls_$(subdomain): delete_cert_$(subdomain).joeac.net - $(if $(shell [ -f $(tls_crontab) ] && echo 1),\ - sudo rm -f $(tls_crontab) - ) -endef - -define obtain_or_renew_cert_cmd = -sudo certbot certonly \ - --nginx \ - --cert-name $(subdomain).joeac.net \ - --domain $(subst @.,,$(subdomain).)joeac.net \ - --non-interactive \ - && sudo chown -R joeac.net:joeac.net $(dir $(tls_cert)) -endef - -is_cert_expired = $(shell sudo certbot certificates --cert-name $(subdomain).joeac.net \ - | grep "Expiry Date" | grep -E "(EXPIRED|REVOKED)") -define cert_rule = -$(tls_cert): - $(obtain_or_renew_cert_cmd) - -.PHONY: renew_$(tls_cert) -renew_$(tls_cert): - $$(if $$(is_cert_expired),$(obtain_or_renew_cert_cmd)) -endef - -$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(install_tls_subdomain_rule))) -$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(reinstall_tls_subdomain_rule))) -$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(uninstall_tls_subdomain_rule))) -$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(cert_rule))) - -.PHONY: remove_/etc/periodic/daily/tls-%.joeac.net -remove_/etc/periodic/daily/tls-%.joeac.net: - rm -f $(@:remove_%=%) - -.PHONY: delete_cert_% -delete_cert_%: - sudo certbot delete --cert-name $(@:delete_cert_%=%).joeac.net --non-interactive - -/etc/periodic/daily/tls-%joeac.net: - echo "#!/bin/sh" > crontab.tmp - echo "$(obtain_or_renew_cert_cmd)" >> crontab.tmp - sudo mv crontab.tmp $@ - sudo chmod +x $@ - -certs_to_renew = $(foreach subdomain,$(filter $(SUBDOMAINS),$(installed_tls_cert_subdomains)),$(tls_cert)) -tls_crontabs_to_install = $(foreach subdomain,$(SUBDOMAINS),$(tls_crontab)) -tls_certs_to_install = $(foreach subdomain,$(SUBDOMAINS),$(tls_cert)) -.PHONY: install_tls -install_tls: $(tls_crontabs_to_install) $(tls_certs_to_install) $(addprefix remove_,$(tls_crontabs_to_remove)) $(addprefix delete_cert_,$(tls_cert_subdomains_to_delete)) $(addprefix renew_,$(certs_to_renew)) - -.PHONY: reinstall_tls -reinstall_tls: install_tls - -.PHONY: uninstall_tls -uninstall_tls: $(foreach subdomain,$(ALL_SUBDOMAINS),$(uninstall_tls_$(subdomain))) - -.PHONY: install_certbot -install_certbot: /usr/bin/certbot /usr/bin/python /usr/lib/$(shell ls /usr/bin | grep python[0-9]\\.)/certbot_nginx - -/usr/bin/certbot /usr/bin/python: - sudo apk add certbot - -/usr/lib/python%/certbot_nginx: - sudo apk add certbot-nginx |