From 2f43ae3d10dcba9bf70f008ef006122b1613f225 Mon Sep 17 00:00:00 2001
From: Joe Carstairs <me@joeac.net>
Date: Wed, 29 Jul 2026 18:28:50 +0100
Subject: move tls cert management from make to ansible

---
 ansible/playbook.yml                 |  3 ++-
 ansible/requirements.yml             |  3 +++
 ansible/roles/tls/files/certbot.fact | 35 +++++++++++++++++++++++++++
 ansible/roles/tls/tasks/main.yml     | 46 ++++++++++++++++++++++++++++++++++++
 4 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 ansible/requirements.yml
 create mode 100644 ansible/roles/tls/files/certbot.fact
 create mode 100644 ansible/roles/tls/tasks/main.yml

(limited to 'ansible')

diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index d91eaa4..84e8052 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -1,7 +1,8 @@
-- name: Install dyndns
+- name: Install dyndns and TLS
   hosts: blade-canongate
   become: true
   roles:
     - dyndns
+    - tls
   vars_files:
     - common.yml
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
new file mode 100644
index 0000000..8eb5526
--- /dev/null
+++ b/ansible/requirements.yml
@@ -0,0 +1,3 @@
+collections:
+  - name: community.general
+    version: 13.2.0
diff --git a/ansible/roles/tls/files/certbot.fact b/ansible/roles/tls/files/certbot.fact
new file mode 100644
index 0000000..baa43bb
--- /dev/null
+++ b/ansible/roles/tls/files/certbot.fact
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+certbot_certificates_output="$(certbot certificates 2>/dev/null)"
+certificates="$(echo "$certbot_certificates_output" | grep "Certificate Name:" | sed "s/.*Certificate Name: *//g")"
+all_certificates=""
+valid_certificates=""
+invalid_certificates=""
+for certificate in $certificates
+do
+  all_certificates="$all_certificates $certificate"
+  if [ -n "$(echo "$certbot_certificates_output" | grep "Expiry Date:" | grep -E "VALID:")" ]
+  then
+    valid_certificates="$valid_certificates $certificate"
+  else
+    invalid_certificates="$invalid_certificates $certificate"
+  fi
+done
+
+jsonify()
+{
+  if [ -z "$1" ]
+  then
+    echo "[]"
+  else
+    echo "[\"$1\"]" | sed "s/ /\", \"/g"
+  fi
+}
+
+cat <<EOF
+{
+  "certificates": $(jsonify "$all_certificates"),
+  "invalid_certificates": $(jsonify "$invalid_certificates"),
+  "valid_certificates": $(jsonify "$valid_certificates")
+}
+EOF
diff --git a/ansible/roles/tls/tasks/main.yml b/ansible/roles/tls/tasks/main.yml
new file mode 100644
index 0000000..d26435b
--- /dev/null
+++ b/ansible/roles/tls/tasks/main.yml
@@ -0,0 +1,46 @@
+- name: Create Ansible facts directory
+  ansible.builtin.file:
+    path: /etc/ansible/facts.d
+    state: directory
+    recurse: true
+
+- name: Install certbot facts script
+  register: certbot_fact_script
+  ansible.builtin.copy:
+    src: certbot.fact
+    dest: /etc/ansible/facts.d/certbot.fact
+    mode: "775"
+
+- name: Re-gather custom facts
+  when: certbot_fact_script is changed
+  ansible.builtin.setup:
+    filter: ansible_local
+
+- name: Install certbot and nginx
+  community.general.apk:
+    name:
+      - certbot
+      - nginx
+    state: present
+
+- name: Renew all TLS certificates that are near expiry
+  when: ( ansible_local.certbot.invalid_certificates | length ) > 0
+  ansible.builtin.shell:
+    certbot renew --non-interactive
+
+- name: Install missing TLS certificates
+  loop: "{{ subdomains }}"
+  when: not ( ( item ~ ".joeac.net" ) in ansible_local.certbot.certificates )
+  ansible.builtin.shell:
+    certbot certonly \
+     	--nginx \
+     	--cert-name {{ item }}.joeac.net \
+     	--domain {% if item == "@" %} joeac.net {% else %} {{ item }}.joeac.net {% endif %} \
+     	--non-interactive
+
+- name: Install daily crontab to renew TLS certificates
+  ansible.builtin.cron:
+    special_time: daily
+    name: daily crontab to renew all TLS certificates near to expiry
+    job:
+      certbot renew --non-interactive
-- 
cgit v1.2.3