diff options
Diffstat (limited to 'ansible/roles/tls/tasks/main.yml')
| -rw-r--r-- | ansible/roles/tls/tasks/main.yml | 28 |
1 files changed, 26 insertions, 2 deletions
diff --git a/ansible/roles/tls/tasks/main.yml b/ansible/roles/tls/tasks/main.yml index d26435b..e758fc5 100644 --- a/ansible/roles/tls/tasks/main.yml +++ b/ansible/roles/tls/tasks/main.yml @@ -29,7 +29,7 @@ certbot renew --non-interactive - name: Install missing TLS certificates - loop: "{{ subdomains }}" + loop: "{{ subdomains | map(attribute='name') }}" when: not ( ( item ~ ".joeac.net" ) in ansible_local.certbot.certificates ) ansible.builtin.shell: certbot certonly \ @@ -38,9 +38,33 @@ --domain {% if item == "@" %} joeac.net {% else %} {{ item }}.joeac.net {% endif %} \ --non-interactive +- name: Add joeac.net group + ansible.builtin.group: + name: joeac.net + +- name: Add tls group + ansible.builtin.group: + name: tls + +- name: Add joeac.net user + ansible.builtin.user: + name: joeac.net + group: joeac.net + groups: + - tls + append: false + +- name: Give ownership of /etc/letsencrypt to joeac.net:tls + ansible.builtin.file: + path: /etc/letsencrypt + owner: joeac.net + group: tls + mode: g+rwx + recurse: true + - name: Install daily crontab to renew TLS certificates ansible.builtin.cron: special_time: daily name: daily crontab to renew all TLS certificates near to expiry job: - certbot renew --non-interactive + certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt |