-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixes #4
- Loading branch information
Showing
11 changed files
with
84 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,3 @@ | ||
--- | ||
- src: bviktor.file_changed | ||
- src: bviktor.setfcontext |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,3 @@ | ||
--- | ||
- src: bviktor.file_changed | ||
- src: bviktor.setfcontext |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,43 +1,83 @@ | ||
--- | ||
- name: Create cert deployment directory | ||
file: | ||
path: "{{ acme_domain_dir }}" | ||
state: directory | ||
owner: root | ||
group: root | ||
mode: '0700' | ||
|
||
- name: Check for existing cert | ||
stat: | ||
path: "/root/.acme.sh/{{ domain }}/{{ domain }}.cer" | ||
path: "{{ deploy_cert_file }}" | ||
register: current_file | ||
|
||
# rc = 1 both when expires, and when doesn't exist / not a valid cert | ||
- name: Check current cert expiry | ||
command: | ||
cmd: "openssl x509 -checkend {{ eff_min_days | int * 86400 }} -noout -in /root/.acme.sh/{{ domain }}/{{ domain }}.cer" | ||
cmd: "openssl x509 -checkend {{ eff_min_days | int * 86400 }} -noout -in {{ deploy_cert_file }}" | ||
changed_when: false | ||
failed_when: current_expiry.rc != 0 and current_expiry.stderr | length | ||
register: current_expiry | ||
when: current_file.stat.exists | ||
|
||
- name: Check if current cert is wildcard | ||
shell: | ||
cmd: "openssl x509 -ext subjectAltName -noout -in /root/.acme.sh/{{ domain }}/{{ domain }}.cer | grep '*.{{ domain }}'" | ||
cmd: "openssl x509 -ext subjectAltName -noout -in {{ deploy_cert_file }} | grep '*.{{ domain }}'" | ||
changed_when: false | ||
failed_when: false | ||
register: current_wildcard | ||
when: current_file.stat.exists | ||
|
||
- name: Obtain initial cert # noqa no-changed-when | ||
- include_role: | ||
name: bviktor.file_changed | ||
vars: | ||
path: "{{ deploy_cert_file }}" | ||
mode: before | ||
|
||
- name: Obtain initial cert | ||
command: | ||
cmd: "{{ acme_sh_dir }}/acme.sh {% if eff_staging %}--staging{% else %}--server letsencrypt{% endif %} --keylength 4096 --issue --dns dns_{{ provider }} --dnssleep {{ eff_sleep }} --force -d {{ domain }}{% if eff_wildcard %} -d *.{{ domain }}{% endif %}" | ||
cmd: "{{ acme_install_dir }}/acme.sh {% if eff_staging %}--staging{% else %}--server letsencrypt{% endif %} --ecc --issue --dns dns_{{ provider }} --dnssleep {{ eff_sleep }} --force --domain {{ domain }}{% if eff_wildcard %} --domain *.{{ domain }}{% endif %}" | ||
environment: "{{ credential }}" | ||
changed_when: false | ||
when: not current_file.stat.exists or (eff_wildcard and current_wildcard.rc != 0) | ||
|
||
- name: Renew existing cert # noqa no-changed-when | ||
- name: Renew existing cert | ||
command: | ||
cmd: "{{ acme_sh_dir }}/acme.sh {% if eff_staging %}--staging{% else %}--server letsencrypt{% endif %} --keylength 4096 --renew --dns dns_{{ provider }} --dnssleep {{ eff_sleep }} --force -d {{ domain }}{% if eff_wildcard %} -d *.{{ domain }}{% endif %}" | ||
cmd: "{{ acme_install_dir }}/acme.sh {% if eff_staging %}--staging{% else %}--server letsencrypt{% endif %} --ecc --renew --dns dns_{{ provider }} --dnssleep {{ eff_sleep }} --force --domain {{ domain }}{% if eff_wildcard %} --domain *.{{ domain }}{% endif %}" | ||
environment: "{{ credential }}" | ||
changed_when: false | ||
when: current_file.stat.exists and current_expiry.rc != 0 | ||
|
||
# Unlike --issue, --renew updates the files in the target automatically, but it won't hurt to copy twice | ||
- name: Deploy cert | ||
command: | ||
cmd: "{{ acme_install_dir }}/acme.sh --install-cert --ecc --domain {{ domain }}{% if eff_wildcard %} --domain *.{{ domain }}{% endif %} --cert-file {{ deploy_cert_file }} --key-file {{ deploy_key_file }} --ca-file {{ deploy_ca_file }} --fullchain-file {{ deploy_fullchain_file }}" | ||
changed_when: false | ||
|
||
- include_role: | ||
name: bviktor.file_changed | ||
vars: | ||
path: "{{ deploy_cert_file }}" | ||
mode: after | ||
|
||
- debug: | ||
msg: "{% if file_changed.changed %}The certificate has been updated.{% else %}No change has been made to the certificate.{% endif %}" | ||
changed_when: file_changed.changed | ||
|
||
- name: Check obtained cert | ||
command: | ||
cmd: "openssl x509 -issuer -subject -dates -ext subjectAltName -noout -in /root/.acme.sh/{{ domain }}/{{ domain }}.cer" | ||
cmd: "openssl x509 -issuer -subject -dates -ext subjectAltName -noout -in {{ deploy_cert_file }}" | ||
changed_when: false | ||
register: openssl_info | ||
|
||
- debug: | ||
msg: "{{ openssl_info.stdout_lines }}" | ||
|
||
- set_fact: | ||
acme: | ||
cert_file: "{{ deploy_cert_file }}" | ||
key_file: "{{ deploy_key_file }}" | ||
ca_file: "{{ deploy_ca_file }}" | ||
fullchain_file: "{{ deploy_fullchain_file }}" | ||
changed: "{{ file_changed.changed | bool }}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,4 @@ | ||
{{ 60 | random }} 07 1 * * root {{ acme_sh_dir }}/acme.sh {% if eff_staging %}--staging{% else %}--server letsencrypt{% endif %} --keylength 4096 --renew --dns dns_{{ provider }} --dnssleep {{ eff_sleep }} --force -d {{ domain }}{% if eff_wildcard %} -d *.{{ domain }}{% endif %} >> /var/log/letsencrypt 2>&1 | ||
{{ 60 | random }} 07 1 * * root {{ acme_install_dir }}/acme.sh {% if eff_staging %}--staging{% else %}--server letsencrypt{% endif %} --ecc --renew --dns dns_{{ provider }} --dnssleep {{ eff_sleep }} --force --domain {{ domain }}{% if eff_wildcard %} --domain *.{{ domain }}{% endif %} >> /var/log/letsencrypt 2>&1 | ||
|
||
# TODO make params for this | ||
#1 08 1 * * root /sbin/nginx -s reload |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
--- | ||
- debug: | ||
msg: "{{ acme }}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters