roles/server/letsencrypt-bot/tasks/main.yml

   1 #####################################
   2 ### someone's ansible provisioner ###
   3 #####################################
   4 # Part of: https://git.somenet.org/root/pub/somesible.git
   5 # 2017-2024 by someone <someone@somenet.org>
   6 #
   7 ---
   8 - name: install letsencrypt-bot
   9   apt:
  10     pkg:
  11     - ssl-cert
  12     - dehydrated
  13     state: present
  14     policy_rc_d: 101
  15   tags: "online"
  16   ignore_errors: "{{ignore_online_errors | bool}}"
  17
  18
  19 - name: create letsencrypt user
  20   user:
  21     name: "letsencrypt"
  22     home: "/var/lib/letsencrypt"
  23     shell: "/bin/bash"
  24     createhome: no
  25     system: yes
  26     state: present
  27
  28
  29 - name: create letsencrypt user's homedir
  30   file:
  31     path: "/var/lib/letsencrypt"
  32     state: directory
  33     mode: 0750
  34     owner: "letsencrypt"
  35     group: "letsencrypt"
  36
  37
  38 - name: create letsencrypt challenge dir
  39   file:
  40     path: "/var/www/html/dehydrated"
  41     state: directory
  42     mode: 0750
  43     owner: "letsencrypt"
  44     group: "www-data"
  45
  46
  47 - name: create letsencrypt cert dir
  48   file:
  49     path: "/etc/ssl/letsencrypt"
  50     state: directory
  51     mode: 0750
  52     owner: "letsencrypt"
  53     group: "ssl-cert"
  54
  55
  56 - name: create letsencrypt cert-rsa dir
  57   file:
  58     path: "/etc/ssl/letsencrypt-rsa"
  59     state: directory
  60     mode: 0750
  61     owner: "letsencrypt"
  62     group: "ssl-cert"
  63
  64
  65 - name: fix dehydrated dir permissions
  66   file:
  67     path: "/etc/dehydrated"
  68     state: directory
  69     mode: 0750
  70     owner: "letsencrypt"
  71     group: "letsencrypt"
  72
  73
  74 - name: copy config
  75   copy:
  76     src: "{{item}}"
  77     dest: "/etc/dehydrated/config"
  78     mode: 0640
  79     owner: "letsencrypt"
  80     group: "letsencrypt"
  81   with_first_found:
  82     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/config"
  83     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/config"
  84     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/config"
  85     - "default/config"
  86
  87
  88 - name: copy config-rsa
  89   copy:
  90     src: "{{item}}"
  91     dest: "/etc/dehydrated/config-rsa"
  92     mode: 0640
  93     owner: "letsencrypt"
  94     group: "letsencrypt"
  95   with_first_found:
  96     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/config-rsa"
  97     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/config-rsa"
  98     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/config-rsa"
  99     - "default/config-rsa"
 100
 101
 102 - name: copy hook.sh
 103   copy:
 104     src: "{{item}}"
 105     dest: "/etc/dehydrated/hook.sh"
 106     mode: 0750
 107     owner: "letsencrypt"
 108     group: "letsencrypt"
 109   with_first_found:
 110     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/hook.sh"
 111     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/hook.sh"
 112     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/hook.sh"
 113     - "default/hook.sh"
 114
 115
 116 - name: copy domains.txt header
 117   copy:
 118     src: "{{item}}"
 119     dest: "/etc/dehydrated/domains.txt"
 120     mode: 0640
 121     owner: "root"
 122     group: "letsencrypt"
 123   with_first_found:
 124     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/domains.txt"
 125     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/domains.txt"
 126     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/domains.txt"
 127     - "default/domains.txt"
 128   changed_when: False
 129
 130
 131 - name: register with letsencrypt
 132   command: "/usr/bin/dehydrated --register --accept-terms"
 133   args:
 134     creates: "/var/lib/letsencrypt/accounts/"
 135   become: true
 136   become_user: "letsencrypt"
 137   tags: "online"
 138
 139
 140 - name: copy crontab entry
 141   copy:
 142     src: "{{item}}"
 143     dest: "/etc/cron.d/letsencrypt-dehydrated"
 144     mode: 0644
 145     owner: "root"
 146     group: "root"
 147   with_first_found:
 148     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/letsencrypt-dehydrated.cron"
 149     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/letsencrypt-dehydrated.cron"
 150     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/letsencrypt-dehydrated.cron"
 151     - "default/letsencrypt-dehydrated.cron"