ansible-personal/roles/nginx/tasks/letsencrypt.yml

---

- block:
  - name: Copy systemd service to renew Let's Encrypt certs
    template: src=renew-letsencrypt.service.j2 dest=/etc/systemd/system/renew-letsencrypt.service mode=0644 owner=root group=root

  - name: Copy systemd timer to renew Let's Encrypt certs
    copy: src=renew-letsencrypt.timer dest=/etc/systemd/system/renew-letsencrypt.timer mode=0644 owner=root group=root

  # always issues daemon-reload just in case the server/timer changed
  - name: Start and enable systemd timer to renew Let's Encrypt certs
    systemd: name=renew-letsencrypt.timer state=started enabled=yes daemon_reload=yes

  - name: Download certbot
    get_url: dest={{ letsencrypt_certbot_dest }} url=https://dl.eff.org/certbot-auto mode=700

  - name: Install certbot dependencies (Ubuntu 16.04)
    when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version_compare('16.04', '==')
    apt: name={{ letsencrypt_deps_ubuntu_xenial }} state=present update_cache=yes

  - name: Install certbot dependencies (Ubuntu 18.04)
    when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version_compare('18.04', '==')
    apt: name={{ letsencrypt_deps_ubuntu_bionic }} state=present update_cache=yes

  - name: Install certbot dependencies (Debian 9)
    when: ansible_distribution == 'Debian' and ansible_distribution_major_version is version_compare('9', '==')
    apt: name={{ letsencrypt_deps_debian_stretch }} state=present update_cache=yes
  tags: letsencrypt

# vim: set ts=2 sw=2:
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt. 2016-06-27 22:52:39 +02:00			`---`

roles/nginx: Use dynamic includes for Let's Encrypt As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. Also, I had to move the letsencrypt tasks to the main task file so the tags were available (due to dynamic tasks not inheriting tags). 2018-04-26 10:00:47 +02:00			`- block:`
			`- name: Copy systemd service to renew Let's Encrypt certs`
			`template: src=renew-letsencrypt.service.j2 dest=/etc/systemd/system/renew-letsencrypt.service mode=0644 owner=root group=root`

			`- name: Copy systemd timer to renew Let's Encrypt certs`
			`copy: src=renew-letsencrypt.timer dest=/etc/systemd/system/renew-letsencrypt.timer mode=0644 owner=root group=root`

			`# always issues daemon-reload just in case the server/timer changed`
			`- name: Start and enable systemd timer to renew Let's Encrypt certs`
			`systemd: name=renew-letsencrypt.timer state=started enabled=yes daemon_reload=yes`

			`- name: Download certbot`
			`get_url: dest={{ letsencrypt_certbot_dest }} url=https://dl.eff.org/certbot-auto mode=700`

			`- name: Install certbot dependencies (Ubuntu 16.04)`
			`when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version_compare('16.04', '==')`
			`apt: name={{ letsencrypt_deps_ubuntu_xenial }} state=present update_cache=yes`

			`- name: Install certbot dependencies (Ubuntu 18.04)`
			`when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version_compare('18.04', '==')`
			`apt: name={{ letsencrypt_deps_ubuntu_bionic }} state=present update_cache=yes`

			`- name: Install certbot dependencies (Debian 9)`
			`when: ansible_distribution == 'Debian' and ansible_distribution_major_version is version_compare('9', '==')`
			`apt: name={{ letsencrypt_deps_debian_stretch }} state=present update_cache=yes`
roles/nginx: Use dynamic include_tasks for Let's Encrypt Use dynamic includes instead of static imports when you are running tasks conditionally or using variable interpolation. The down side is that you need to then tag the parent task as well as all child tasks, as tags only apply to children of statically imported tasks. 2018-04-25 19:03:32 +02:00			`tags: letsencrypt`
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt. 2016-06-27 22:52:39 +02:00
			`# vim: set ts=2 sw=2:`