99 lines
2.5 KiB
YAML
99 lines
2.5 KiB
YAML
|
---
|
||
|
|
|
||
|
|
- name: Install certbot
|
||
|
|
get_url:
|
||
|
|
url: https://dl.eff.org/certbot-auto
|
||
|
|
dest: /usr/bin/certbot-auto
|
||
|
|
mode: "a+x"
|
||
|
|
tags:
|
||
|
|
- lesencrypt
|
||
|
|
- nginxrevproxy
|
||
|
|
|
||
|
|
- name: Get Active Sites
|
||
|
|
command: ls -1 /etc/nginx/sites-enabled/
|
||
|
|
changed_when: "active.stdout_lines != nginx_revproxy_sites.keys()|sort()"
|
||
|
|
check_mode: false
|
||
|
|
register: active
|
||
|
|
tags:
|
||
|
|
- lesencrypt
|
||
|
|
- nginxrevproxy
|
||
|
|
|
||
|
|
- name: Enable sites for ACME protocol
|
||
|
|
block:
|
||
|
|
- name: Add Https Site Config
|
||
|
|
template:
|
||
|
|
src: reverseproxy_ssl.conf.j2
|
||
|
|
dest: /etc/nginx/sites-available/{{ item.key }}.conf
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
with_dict: "{{ nginx_revproxy_sites }}"
|
||
|
|
register: siteconfig
|
||
|
|
when:
|
||
|
|
- item.value.letsencrypt | default(False)
|
||
|
|
- item.key not in active.stdout_lines
|
||
|
|
|
||
|
|
- name: Enable Site Config
|
||
|
|
file:
|
||
|
|
src: /etc/nginx/sites-available/{{ item.key }}.conf
|
||
|
|
dest: /etc/nginx/sites-enabled/{{ item.key }}
|
||
|
|
state: link
|
||
|
|
with_dict: "{{ nginx_revproxy_sites }}"
|
||
|
|
register: site_enabled
|
||
|
|
when:
|
||
|
|
- siteconfig is success
|
||
|
|
- not ansible_check_mode
|
||
|
|
- item.value.letsencrypt | default(False)
|
||
|
|
- item.key not in active.stdout_lines
|
||
|
|
|
||
|
|
- name: Reload Nginx
|
||
|
|
service:
|
||
|
|
name: nginx
|
||
|
|
state: reloaded
|
||
|
|
when:
|
||
|
|
- site_enabled is success
|
||
|
|
when:
|
||
|
|
- active.changed
|
||
|
|
- nginxinstalled is success
|
||
|
|
tags:
|
||
|
|
- lesencrypt
|
||
|
|
- nginxrevproxy
|
||
|
|
|
||
|
|
- name: Generate certs (first time)
|
||
|
|
command: |
|
||
|
|
certbot-auto certonly
|
||
|
|
--webroot -w /var/www/{{ item.key }}
|
||
|
|
-d {{ item.value.domains | join(' -d ') }}
|
||
|
|
--email {{ item.value.letsencrypt_email }}
|
||
|
|
--non-interactive --cert-name {{ item.key }}
|
||
|
|
--agree-tos creates=/etc/letsencrypt/live/{{ item.key }}/fullchain.pem
|
||
|
|
with_dict: "{{ nginx_revproxy_sites }}"
|
||
|
|
when: item.value.letsencrypt | default(False)
|
||
|
|
tags:
|
||
|
|
- lesencrypt
|
||
|
|
- nginxrevproxy
|
||
|
|
|
||
|
|
- name: Update Site Config
|
||
|
|
template:
|
||
|
|
src: reverseproxy_ssl_letsencrypt.conf.j2
|
||
|
|
dest: /etc/nginx/sites-available/{{ item.key }}.conf
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
with_dict: "{{ nginx_revproxy_sites }}"
|
||
|
|
notify: Reload Nginx
|
||
|
|
when:
|
||
|
|
- item.value.letsencrypt | default(False)
|
||
|
|
tags:
|
||
|
|
- lesencrypt
|
||
|
|
- nginxrevproxy
|
||
|
|
|
||
|
|
- name: Insert cert-bot renew in crontab
|
||
|
|
cron:
|
||
|
|
name: "cert-bot renew"
|
||
|
|
job: 'certbot-auto renew --post-hook "systemctl reload nginx" >> /var/log/letsencrypt/letsencrypt-update.log 2>&1'
|
||
|
|
hour: "3"
|
||
|
|
minute: "30"
|
||
|
|
weekday: "1"
|
||
|
|
tags:
|
||
|
|
- lesencrypt
|
||
|
|
- nginxrevproxy
|