blob: b7d0df0522e3af9ce18220742184f8b0c7501937 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
- name: check required variables
fail:
msg: "value of {{ item }} should no be FIXME!"
with_items:
- letsencrypt_domain
- letsencrypt_email
- letsencrypt_server
when: item == "FIXME"
- name: install deploy_certs_haproxy
template:
src: deploy_certs_haproxy
dest: /usr/local/sbin/deploy_certs_haproxy
owner: root
group: root
mode: 0755
when: letsencrypt
- name: install certbot
apt:
name: certbot
default_release: stretch-backports
when: letsencrypt
- name: install haproxy
apt:
name: haproxy
- name: install ssl-cert
apt:
name: ssl-cert
when: not letsencrypt
- name: stop haproxy
ignore_errors: true
systemd:
name: haproxy
state: stopped
- name: install snakeoil certificate for haproxy
shell: |
cat /etc/ssl/certs/ssl-cert-snakeoil.pem \
/etc/ssl/private/ssl-cert-snakeoil.key \
> /etc/haproxy/haproxy.pem
when: not letsencrypt
- name: fetch new certificate
command: >
certbot certonly
--standalone
--noninteractive
--domain "{{ letsencrypt_domain }}"
--email "{{ letsencrypt_email }}"
--agree-tos
when: letsencrypt
- name: install new cert for haproxy
command: /usr/local/sbin/deploy_certs_haproxy
when: letsencrypt
- name: start haproxy
ignore_errors: true
systemd:
name: haproxy
state: started
- name: add cron job
cron:
name: letsencrypt
hour: 23
minute: 42
user: root
job: >
certbot renew
--standalone
--quiet
--pre-hook "systemctl stop haproxy"
--post-hook "/usr/local/sbin/deploy_certs_haproxy && systemctl start haproxy"
when: letsencrypt
|
