mirror of https://dev.ccchb.de/ccchb/ansible.git
Renew Let's Encrypt certificates
This commit is contained in:
parent
7192608aee
commit
98a412c27b
|
@ -43,7 +43,7 @@
|
|||
state: directory
|
||||
owner: vmail
|
||||
group: vmail
|
||||
mode: 0750
|
||||
mode: 0755
|
||||
|
||||
- name: Create /var/spool/postfix
|
||||
file:
|
||||
|
|
|
@ -12,3 +12,6 @@
|
|||
|
||||
- name: Reload HAProxy
|
||||
command: s6-svc -2 /run/service/haproxy
|
||||
|
||||
- name: Restart acme-renew
|
||||
command: s6-svc -wU -T 5000 -ru /run/service/acme-renew
|
||||
|
|
|
@ -266,3 +266,60 @@
|
|||
creates: '/usr/local/etc/haproxy/{{ item }}.pem'
|
||||
with_items:
|
||||
- '{{ ansible_fqdn }}'
|
||||
|
||||
- name: Create acme.sh renew service directories
|
||||
file:
|
||||
path: '/etc/s6-rc/service/{{ item }}'
|
||||
state: directory
|
||||
owner: root
|
||||
group: wheel
|
||||
mode: 0755
|
||||
with_items: '{{ acme_service_dirs }}'
|
||||
notify:
|
||||
- Reload s6-rc
|
||||
- Restart acme-renew
|
||||
|
||||
- name: Generate acme.sh renew service scripts
|
||||
template:
|
||||
dest: '/etc/s6-rc/service/{{ item }}'
|
||||
src: '{{ item }}.j2'
|
||||
mode: 0555
|
||||
owner: root
|
||||
group: wheel
|
||||
with_items: '{{ acme_service_scripts }}'
|
||||
notify:
|
||||
- Reload s6-rc
|
||||
- Restart acme-renew
|
||||
|
||||
- name: Generate acme.sh renew service configuration
|
||||
copy:
|
||||
dest: '/etc/s6-rc/service/{{ item.name }}'
|
||||
content: '{{ item.content }}'
|
||||
mode: 0444
|
||||
owner: root
|
||||
group: wheel
|
||||
loop_control:
|
||||
label: '{{ item.name }} = {{ item.content }}'
|
||||
with_items: '{{ acme_service_config }}'
|
||||
notify:
|
||||
- Reload s6-rc
|
||||
- Restart acme-renew
|
||||
|
||||
- name: Flush handlers
|
||||
meta: flush_handlers
|
||||
|
||||
- name: Start acme renew service
|
||||
command: fdmove -c 2 1 s6-rc -u -v 2 change acme-renew
|
||||
register: change
|
||||
changed_when: change.stdout | length > 0
|
||||
|
||||
- name: Enable acme-renew
|
||||
lineinfile:
|
||||
path: /etc/s6-rc/service/enabled/contents
|
||||
regexp: "^acme-renew$"
|
||||
line: "acme-renew"
|
||||
notify:
|
||||
- Reload s6-rc
|
||||
|
||||
- name: Flush handlers (again)
|
||||
meta: flush_handlers
|
||||
|
|
|
@ -0,0 +1,13 @@
|
|||
#!/usr/local/bin/execlineb -S2
|
||||
# {{ ansible_managed }}
|
||||
|
||||
s6-envdir ./env
|
||||
multisubstitute {
|
||||
importas -i -u NAME NAME
|
||||
}
|
||||
|
||||
fdmove -c 1 2
|
||||
ifelse { test "${1}" -eq 0 } {
|
||||
echo "${NAME}: Stopped."
|
||||
}
|
||||
echo "${NAME}: Failed with exit status (${1}, ${2})."
|
|
@ -0,0 +1,23 @@
|
|||
#!/usr/local/bin/execlineb -P
|
||||
# {{ ansible_managed }}
|
||||
|
||||
s6-envdir ./env
|
||||
multisubstitute {
|
||||
importas -i -u NAME NAME
|
||||
importas -i -u USER USER
|
||||
importas -i -u GROUP GROUP
|
||||
importas -i -u MODE MODE
|
||||
importas -i -u DIR DIR
|
||||
}
|
||||
|
||||
foreground { fdmove -c 1 2 echo "${NAME} log: Starting." }
|
||||
|
||||
ifelse -n { install -d -o "${USER}" -g "${GROUP}" -m "${MODE}" "$DIR" } {
|
||||
foreground { fdmove -c 1 2 echo "${NAME} log: Failed to create logging directory." }
|
||||
false
|
||||
}
|
||||
|
||||
fdmove -c 2 1
|
||||
|
||||
s6-envuidgid $USER
|
||||
s6-log -d 3 T $DIR
|
|
@ -0,0 +1,5 @@
|
|||
#!/bin/sh
|
||||
# {{ ansible_managed }}
|
||||
|
||||
sudo -u acme acme.sh --debug --home /var/db/acme --standalone --httpport 8080 --renew-all
|
||||
sudo -u acme acme.sh --debug --home /var/db/acme --standalone --httpport 8080 --deploy --domain {{ ansible_fqdn }} --deploy-hook haproxy
|
|
@ -0,0 +1,14 @@
|
|||
#!/usr/local/bin/execlineb -S2
|
||||
# {{ ansible_managed }}
|
||||
|
||||
s6-envdir ./env
|
||||
multisubstitute {
|
||||
importas -i -u NAME NAME
|
||||
}
|
||||
|
||||
fdmove -c 1 2
|
||||
ifelse { test "${1}" -eq 0 } {
|
||||
echo "${NAME}: Stopped."
|
||||
}
|
||||
|
||||
echo "${NAME}: Failed with exit status (${1}, ${2})."
|
|
@ -0,0 +1,12 @@
|
|||
#!/usr/local/bin/execlineb -P
|
||||
# {{ ansible_managed }}
|
||||
|
||||
s6-envdir ./env
|
||||
multisubstitute {
|
||||
importas -i -u NAME NAME
|
||||
}
|
||||
|
||||
foreground { fdmove -c 1 2 echo "${NAME}: Starting." }
|
||||
|
||||
fdmove -c 2 1
|
||||
snooze -v data/job
|
|
@ -12,3 +12,48 @@ haproxy_s6_templates:
|
|||
- run
|
||||
- finish
|
||||
- data/check
|
||||
|
||||
acme_service_dirs:
|
||||
- acme-renew
|
||||
- acme-renew/env
|
||||
- acme-renew/data
|
||||
- acme-renew-log
|
||||
- acme-renew-log/env
|
||||
|
||||
acme_service_scripts:
|
||||
- acme-renew/run
|
||||
- acme-renew/finish
|
||||
- acme-renew/data/job
|
||||
- acme-renew-log/run
|
||||
- acme-renew-log/finish
|
||||
|
||||
acme_service_config:
|
||||
- name: acme-renew/type
|
||||
content: longrun
|
||||
- name: acme-renew/dependencies
|
||||
content: postfix
|
||||
- name: acme-renew/env/NAME
|
||||
content: acme-renew
|
||||
- name: acme-renew/env/PATH
|
||||
content: /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin
|
||||
- name: acme-renew/producer-for
|
||||
content: acme-renew-log
|
||||
|
||||
- name: acme-renew-log/type
|
||||
content: longrun
|
||||
- name: acme-renew-log/notification-fd
|
||||
content: '3'
|
||||
- name: acme-renew-log/consumer-for
|
||||
content: acme-renew
|
||||
- name: acme-renew-log/env/NAME
|
||||
content: acme-renew
|
||||
- name: acme-renew-log/env/PATH
|
||||
content: /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin
|
||||
- name: acme-renew-log/env/MODE
|
||||
content: '750'
|
||||
- name: acme-renew-log/env/USER
|
||||
content: s6-log
|
||||
- name: acme-renew-log/env/GROUP
|
||||
content: s6-log
|
||||
- name: acme-renew-log/env/DIR
|
||||
content: /var/log/acme-renew
|
||||
|
|
Loading…
Reference in New Issue