]> git.somenet.org - root/pub/somesible.git/blob - roles/server/letsencrypt-bot/tasks/main.yml
roles/service/mattermost/defaults
[root/pub/somesible.git] / roles / server / letsencrypt-bot / tasks / main.yml
1 #####################################
2 ### someone's ansible provisioner ###
3 #####################################
4 # Part of: https://git.somenet.org/root/pub/somesible.git
5 # 2017-2024 by someone <someone@somenet.org>
6 #
7 ---
8 - name: install letsencrypt-bot
9   apt:
10     pkg:
11     - ssl-cert
12     - dehydrated
13     state: present
14     policy_rc_d: 101
15   tags: "online"
16   ignore_errors: "{{ignore_online_errors | bool}}"
17
18
19 - name: create letsencrypt user
20   user:
21     name: "letsencrypt"
22     home: "/var/lib/letsencrypt"
23     shell: "/bin/bash"
24     createhome: no
25     system: yes
26     state: present
27
28
29 - name: create letsencrypt user's homedir
30   file:
31     path: "/var/lib/letsencrypt"
32     state: directory
33     mode: 0750
34     owner: "letsencrypt"
35     group: "letsencrypt"
36
37
38 - name: create letsencrypt challenge dir
39   file:
40     path: "/var/www/html/dehydrated"
41     state: directory
42     mode: 0750
43     owner: "letsencrypt"
44     group: "www-data"
45
46
47 - name: create letsencrypt cert dir
48   file:
49     path: "/etc/ssl/letsencrypt"
50     state: directory
51     mode: 0750
52     owner: "letsencrypt"
53     group: "ssl-cert"
54
55
56 - name: create letsencrypt cert-rsa dir
57   file:
58     path: "/etc/ssl/letsencrypt-rsa"
59     state: directory
60     mode: 0750
61     owner: "letsencrypt"
62     group: "ssl-cert"
63
64
65 - name: fix dehydrated dir permissions
66   file:
67     path: "/etc/dehydrated"
68     state: directory
69     mode: 0750
70     owner: "letsencrypt"
71     group: "letsencrypt"
72
73
74 - name: copy config
75   copy:
76     src: "{{item}}"
77     dest: "/etc/dehydrated/config"
78     mode: 0640
79     owner: "letsencrypt"
80     group: "letsencrypt"
81   with_first_found:
82     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/config"
83     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/config"
84     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/config"
85     - "default/config"
86
87
88 - name: copy config-rsa
89   copy:
90     src: "{{item}}"
91     dest: "/etc/dehydrated/config-rsa"
92     mode: 0640
93     owner: "letsencrypt"
94     group: "letsencrypt"
95   with_first_found:
96     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/config-rsa"
97     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/config-rsa"
98     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/config-rsa"
99     - "default/config-rsa"
100
101
102 - name: copy hook.sh
103   copy:
104     src: "{{item}}"
105     dest: "/etc/dehydrated/hook.sh"
106     mode: 0750
107     owner: "letsencrypt"
108     group: "letsencrypt"
109   with_first_found:
110     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/hook.sh"
111     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/hook.sh"
112     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/hook.sh"
113     - "default/hook.sh"
114
115
116 - name: copy domains.txt header
117   copy:
118     src: "{{item}}"
119     dest: "/etc/dehydrated/domains.txt"
120     mode: 0640
121     owner: "root"
122     group: "letsencrypt"
123   with_first_found:
124     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/domains.txt"
125     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/domains.txt"
126     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/domains.txt"
127     - "default/domains.txt"
128   changed_when: False
129
130
131 - name: register with letsencrypt
132   command: "/usr/bin/dehydrated --register --accept-terms"
133   args:
134     creates: "/var/lib/letsencrypt/accounts/"
135   become: true
136   become_user: "letsencrypt"
137   tags: "online"
138
139
140 - name: copy crontab entry
141   copy:
142     src: "{{item}}"
143     dest: "/etc/cron.d/letsencrypt-dehydrated"
144     mode: 0644
145     owner: "root"
146     group: "root"
147   with_first_found:
148     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/letsencrypt-dehydrated.cron"
149     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/letsencrypt-dehydrated.cron"
150     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/letsencrypt-dehydrated.cron"
151     - "default/letsencrypt-dehydrated.cron"