alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
alpine
ansible-personal/roles/nginx/tasks/letsencrypt.yml

138 lines
4.2 KiB
YAML
Raw Permalink Normal View History

roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt.
2016-06-27 22:52:39 +02:00
---
roles/nginx: Use dynamic includes for Let's Encrypt As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. Also, I had to move the letsencrypt tasks to the main task file so the tags were available (due to dynamic tasks not inheriting tags).
2018-04-26 10:00:47 +02:00
- block:
- name: Copy systemd service to renew Let's Encrypt certs
template: src=renew-letsencrypt.service.j2 dest=/etc/systemd/system/renew-letsencrypt.service mode=0644 owner=root group=root
- name: Copy systemd timer to renew Let's Encrypt certs
copy: src=renew-letsencrypt.timer dest=/etc/systemd/system/renew-letsencrypt.timer mode=0644 owner=root group=root
# always issues daemon-reload just in case the server/timer changed
- name: Start and enable systemd timer to renew Let's Encrypt certs
systemd: name=renew-letsencrypt.timer state=started enabled=yes daemon_reload=yes
- name: Download certbot
get_url: dest={{ letsencrypt_certbot_dest }} url=https://dl.eff.org/certbot-auto mode=700
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
# Dependencies certbot checks for on its first run. I set them in a fact so that
# I can pass the list directly to the apt module to install in one transaction.
- name: Set certbot dependencies (Debian 10)
Use version() instad of version_compare() This changed in Ansible 2.5 apparently. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_tests.html
2020-03-09 14:20:51 +01:00
when: ansible_distribution == 'Debian' and ansible_distribution_major_version is version('10', '==')
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
set_fact:
certbot_dependencies:
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- augeas-lenses
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
- binutils
- binutils-common
- binutils-x86-64-linux-gnu
- cpp
- cpp-8
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- gcc
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
- gcc-8
- libasan5
- libatomic1
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- libaugeas0
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
- libbinutils
- libc-dev-bin
- libc6-dev
- libcc1-0
- libexpat1-dev
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- libffi-dev
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
- libgcc-8-dev
- libgomp1
- libisl19
- libitm1
- liblsan0
- libmpc3
- libmpfr6
- libmpx2
- libpython-dev
- libpython2-dev
- libpython2.7
- libpython2.7-dev
- libquadmath0
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- libssl-dev
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
- libtsan0
- libubsan1
- linux-libc-dev
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- python-dev
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
- python-pip-whl
- python-pkg-resources
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- python-virtualenv
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
- python2-dev
- python2.7-dev
- python3-distutils
- python3-lib2to3
- python3-virtualenv
roles/nginx: Update certbot dependencies for Debian 10 Taken after a clean Debian 10 install on Linode.
2019-07-23 17:38:33 +02:00
- virtualenv
roles/nginx: Set Let's Encrypt packages for Debian 10 Taken from the list of packages that the certbot-auto script wants to bootstrap on a fresh Debian 10 "buster" install.
2019-07-06 12:00:22 +02:00
roles/nginx: Use set_fact to set certbot dependencies Instead of looping over a list of items to install, we can actually just give a list directly to the apt module. This allows the module to install all packages in one transaction, which is faster as well as slightly safer for some dependency resolution scenarios.
2018-04-26 18:48:05 +02:00
# Dependencies certbot checks for on its first run. I set them in a fact so that
# I can pass the list directly to the apt module to install in one transaction.
- name: Set certbot dependencies (Ubuntu 18.04)
Use version() instad of version_compare() This changed in Ansible 2.5 apparently. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_tests.html
2020-03-09 14:20:51 +01:00
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==')
roles/nginx: Use set_fact to set certbot dependencies Instead of looping over a list of items to install, we can actually just give a list directly to the apt module. This allows the module to install all packages in one transaction, which is faster as well as slightly safer for some dependency resolution scenarios.
2018-04-26 18:48:05 +02:00
set_fact:
certbot_dependencies:
- augeas-lenses
- binutils
- binutils-common
- binutils-x86-64-linux-gnu
- cpp
- cpp-7
- gcc
- gcc-7
- gcc-7-base
- libasan4
- libatomic1
- libaugeas0
- libbinutils
- libc-dev-bin
- libc6-dev
- libcc1-0
- libcilkrts5
- libexpat1-dev
- libffi-dev
- libgcc-7-dev
- libgomp1
- libisl19
- libitm1
- liblsan0
- libmpc3
- libmpx2
- libpython-dev
- libpython2.7
- libpython2.7-dev
- libquadmath0
- libssl-dev
- libtsan0
- libubsan0
- linux-libc-dev
- python-dev
- python-pip-whl
- python-pkg-resources
- python-virtualenv
- python2.7-dev
- python3-virtualenv
- virtualenv
roles/nginx: Use dynamic includes for Let's Encrypt As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. Also, I had to move the letsencrypt tasks to the main task file so the tags were available (due to dynamic tasks not inheriting tags).
2018-04-26 10:00:47 +02:00
roles/nginx: Use set_fact to set certbot dependencies Instead of looping over a list of items to install, we can actually just give a list directly to the apt module. This allows the module to install all packages in one transaction, which is faster as well as slightly safer for some dependency resolution scenarios.
2018-04-26 18:48:05 +02:00
- name: Install certbot dependencies
apt: name={{ certbot_dependencies }} state=present update_cache=yes
roles/nginx: Adjust certbot tasks It seems that it is no longer recommended/supported to install the standalone certbot-auto client on Ubuntu 20.04. We apparently need to use the one provided by Ubuntu, which luckily includes a service and timer to renew the certs.
2020-05-19 15:41:43 +02:00
when: ansible_distribution != 'Ubuntu' and ansible_distribution_major_version is version('20.04', '!=')
tags: letsencrypt
# On Ubuntu 20.04 it is no longer recommended/supported to use the standalone
# certbot-auto so I guess we need to use the one from the repositories.
roles/nginx: Add pre and post hooks for Let's Encrypt on Ubuntu 20.04 Certbot will run any executables in the pre and post directories during certificate renewal.
2020-06-06 19:38:08 +02:00
- block:
- name: Install certbot (Ubuntu 20.04)
apt: name=certbot state=present update_cache=yes
- name: Copy certbot post and pre hooks for nginx
copy: src={{ item.src }} dest={{ item.dest }} owner=root group=root mode=0755
with_items:
roles/nginx: Fix Let's Encrypt pre/post renewal hooks
2020-12-10 14:20:23 +01:00
- { src: 'stop-nginx.sh', dest: '/etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh' }
roles/nginx: Add pre and post hooks for Let's Encrypt on Ubuntu 20.04 Certbot will run any executables in the pre and post directories during certificate renewal.
2020-06-06 19:38:08 +02:00
- { src: 'start-nginx.sh', dest: '/etc/letsencrypt/renewal-hooks/post/start-nginx.sh' }
roles/nginx: Adjust certbot tasks It seems that it is no longer recommended/supported to install the standalone certbot-auto client on Ubuntu 20.04. We apparently need to use the one provided by Ubuntu, which luckily includes a service and timer to renew the certs.
2020-05-19 15:41:43 +02:00
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')
roles/nginx: Use dynamic include_tasks for Let's Encrypt Use dynamic includes instead of static imports when you are running tasks conditionally or using variable interpolation. The down side is that you need to then tag the parent task as well as all child tasks, as tags only apply to children of statically imported tasks.
2018-04-25 19:03:32 +02:00
tags: letsencrypt
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt.
2016-06-27 22:52:39 +02:00
# vim: set ts=2 sw=2:
Reference in New Issue Copy Permalink