blob: 90ac9f10bb8381183234dfe7b2a6863babc41d61 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
- hosts: server
remote_user: root
tasks:
- name: add APT signing key for the Obnam package repository
copy:
content: |
{{ apt_signing_key }}
dest: /etc/apt/trusted.gpg.d/obnam.asc
- name: add Obnam package repository to APT
apt_repository:
repo: "deb http://ci-prod-controller.vm.liw.fi/debian unstable-ci main"
- name: refresh APT package lists and upgrade all installed packages
apt:
update_cache: true
upgrade: true
- name: install packages for an Obnam server
apt:
name:
- obnam
- psmisc
- name: "install packages for Let's Encrypt TLS certificates"
apt:
name:
- apache2
- dehydrated
- dehydrated-apache2
when: domain is defined
- name: "install cron job to update TLS certificates"
cron:
name: "dehydrated"
cron_file: "dehydrated"
user: root
minute: "0"
hour: "0"
job: "systemctl stop obnam; systemctl start apache2; dehydrated -c; systemctl stop apache2; systemctl start obnam"
- name: create Obnam configuration directory
file:
path: /etc/obnam
state: directory
- name: create Obnam directory for chunk storage
file:
path: /srv/obnam/chunks
state: directory
- name: "install Obnam server configuration for provided TLS certifiactes"
copy:
src: "{{ item }}"
dest: "/etc/obnam/{{ item }}"
with_items:
- server.yaml
- server.key
- server.pem
when: domain is not defined
- name: "install Obnam server configuration for Let's Encrypt TLS certifiactes"
template:
src: server.yaml.j2
dest: /etc/obnam/server.yaml
when: domain is defined
- name: install Obnam service file for systemd
copy:
src: obnam.service
dest: /etc/systemd/system/obnam.service
- name: configure domains for TLS certificates
copy:
content: |
{{ domain }}
dest: /etc/dehydrated/domains.txt
when: domain is defined
- name: stop Obnam service for getting TLS certificates
systemd:
daemon_reload: true
name: obnam
state: stopped
when: domain is defined
- name: start Apache server for getting TLS certificates
systemd:
name: apache2
state: started
when: domain is defined
- name: get TLS certificates
shell: |
dehydrated --register --accept-terms
dehydrated -c
when: domain is defined
- name: stop Apache server so Obnam server can be started again
systemd:
name: apache2
state: stopped
when: domain is defined
- name: start Obnam server
systemd:
name: obnam
enabled: true
state: restarted
vars:
tls_key_path: "/var/lib/dehydrated/certs/{{ domain }}/privkey.pem"
tls_cert_path: "/var/lib/dehydrated/certs/{{ domain }}/cert.pem"
apt_signing_key: |
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBFrLO7kBEADdz6mHstYmKU5Dp6OSjxWtWaqTDOX1sJdmmaIK/9EKVIH0Maxp
5kvVO5G6mULLAjv/kLG0MxasHPrq8I2A/y8AqKAGVL8QelwLjQMIFZ30/VbGQPHS
+T5TZXEnoQtNce1GUhFwJ38ZyjjwHBFV9tSec7rZ2Q3YeM3nNnGPf6DacXGfEOPO
HIN4sXAN2hzNXNjKRzTIvxQseb6nr7afUh/SlZ3yhQOCrIzmYlD7tP9WJe7ofL0p
JY4pDQYw8rT6nC2BE/ioemh84kERCT1vCe+OVFlSRuMlqfEv+ZpKQ+itOmPDQ/lM
jpUm1K2hrW/lWpxT/ZxHKo/w1K36J5WshgMZxfUu5BMCL9LMqMcrXNhNjDMfxDMM
3yBPOvQ4ls6fecOZ/bsFo1p8VzMk/w/eG8vPs5yuNa5XxN95yFMXoOHGb5Xbu8D4
6yiW+Af70LbiSNpGdmNdneiGB2fY38NxBukPw5u3S5qG8HedSmMr1RvSr5kHoAAe
UbOY+BYaaKsTAT7+1skUW1o3FJSqoRKCHAzTsMWC6zzhR8hRn7jVrrguH1hGbqq5
TZSCFQZExuTJ7uXrTLG0WoBXIjB5wWNcSeXn8myUWYB51nJNF4tJBouZOz9JwWGl
kiAQkrHnBttLQWdW9FyjbIoTZMtpvVx+m6ObGTGdGL1cNlLAvWprMXGc+QARAQAB
tDJJY2sgQVBUIHJlcG9zaXRvcnkgc2lnbmluZyBrZXkgKDIwMTgpIDxsaXdAbGl3
LmZpPokCTgQTAQgAOBYhBKL1uyDoXyxUH3O717Wr+TZVS6PGBQJayzu5AhsDBQsJ
CAcCBhUICQoLAgQWAgMBAh4BAheAAAoJELWr+TZVS6PGB5QQANTcikhRUHwt9N4h
dGc/Hp6CbqdshMoWlwpFskttoVDxQG5OAobuZl5XyzGcmja1lT85RGkZFfbca0IZ
LnXOLLSAu51QBkXNaj4OhjK/0uQ+ITrvL6RQSXNgHiUTR/W2XD1GIUq6nBqe2GSN
31S1baYKKVj5QIMsi7Dq8ls3BBXuPCE+xTSaNmGWjes2t9pPidcRvxsksCLY1qgw
P1GFXBeMkBQ29kBP87SUL15SIk7OiQLlEURCy5iRls5rt/YEsdEpRWIb0Tm5Nrjv
2M3VM+iBhfNXTwj0rJ34mlycF1qQmA7YcTEobT7z587GPY0VWzBpQUnEQj7rQWPM
cDYY0b+I6kQ8VKOaL4wVAtE98d7HzFIrIrwhTKufnrWrVDPYsmLZ+LPC1jiF7JBD
SR6Vftb+SdDR9xoE1yRuXbC6IfoW+5/qQNrdQ2mm9BFw5jOonBqchs18HTTf3441
6SWwP9fY3Vi+IZphPPi0Gf85oMStgnv/Wnw6LacEL32ek39Desero/D8iGLZernK
Q2mC9mua5A/bYGVhsNWyURNFkKdbFa+/wW3NfdKYyZnsSfo+jJ2luNewrhAY7Kod
GWXTer9RxzTGA3EXFGvNr+BBOOxSj0SfWTl0Olo7J5dnxof+jLAUS1VHpceHGHps
GSJSdir7NkZidgwoCPA7BTqsb5LN
=dXB0
-----END PGP PUBLIC KEY BLOCK-----
|