alanorth
/
ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
ansible-personal/roles/nginx/tasks/letsencrypt.yml

38 lines
1.5 KiB
YAML
Raw Normal View History

roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt.
2016-06-27 22:52:39 +02:00
---
- name: Copy systemd service to renew Let's Encrypt certs
template: src=renew-letsencrypt.service.j2 dest=/etc/systemd/system/renew-letsencrypt.service mode=0644 owner=root group=root
- name: Copy systemd timer to renew Let's Encrypt certs
copy: src=renew-letsencrypt.timer dest=/etc/systemd/system/renew-letsencrypt.timer mode=0644 owner=root group=root
roles/nginx: Fix issue raised by ansible-lint [ANSIBLE0006] systemctl used in place of systemd module Also, move the functionality of the changed check to the systemd task, because it has the ability to simply daemon-reload itself now.
2017-10-31 22:18:15 +01:00
# always issues daemon-reload just in case the server/timer changed
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt.
2016-06-27 22:52:39 +02:00
- name: Start and enable systemd timer to renew Let's Encrypt certs
roles/nginx: Fix issue raised by ansible-lint [ANSIBLE0006] systemctl used in place of systemd module Also, move the functionality of the changed check to the systemd task, because it has the ability to simply daemon-reload itself now.
2017-10-31 22:18:15 +01:00
systemd: name=renew-letsencrypt.timer state=started enabled=yes daemon_reload=yes
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt.
2016-06-27 22:52:39 +02:00
- name: Download certbot
get_url: dest={{ letsencrypt_certbot_dest }} url=https://dl.eff.org/certbot-auto mode=700
roles/nginx/tasks/letsencrypt.yml: Add system deps for certbot Shit ton of dependencies actually... wow.
2016-10-09 13:06:06 +02:00
- name: Install certbot dependencies (Ubuntu 16.04)
Use new syntax for Jinj2 filters that are used as tests Ansible 2.5.0 uses a new syntax for Jinja2 filters that are used as tests. See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-03-21 20:17:21 +01:00
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version_compare('16.04', '==')
roles/nginx: Separate Ubuntu 16.04 "Xenial" Let's Encrypt deps Instead of iterating over fifteen packages with a loop that does fifteen separate apt transactions, it is better to give the apt module a list so it can install them all in one transaction. This is both quicker and te- chnically more safe for dependency resolution.
2018-04-25 19:01:39 +02:00
apt: name={{ letsencrypt_ubuntu_xenial_deps }} state=present update_cache=yes
tags:
- packages
- letsencrypt
roles/nginx/tasks/letsencrypt.yml: Add system deps for certbot Shit ton of dependencies actually... wow.
2016-10-09 13:06:06 +02:00
roles/nginx: Add dependencies for certbot on Ubuntu 18.04 Taken from running the Let's Encrypt certbot-auto client on a freshly installed Ubuntu 18.04 system.
2018-04-25 18:40:33 +02:00
- name: Install certbot dependencies (Ubuntu 18.04)
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version_compare('18.04', '==')
apt: name={{ letsencrypt_ubuntu_bionic_deps }} state=present update_cache=yes
tags:
- packages
- letsencrypt
roles/nginx: Add package deps for Let's Encrypt on Debian 9 Taken from running certbot-auto on a clean Debian 9 installation.
2017-02-16 17:15:06 +01:00
- name: Install certbot dependencies (Debian 9)
Use new syntax for Jinj2 filters that are used as tests Ansible 2.5.0 uses a new syntax for Jinja2 filters that are used as tests. See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-03-21 20:17:21 +01:00
when: ansible_distribution == 'Debian' and ansible_distribution_major_version is version_compare('9', '==')
roles/nginx: Separate Debian 9 "stretch" Let's Encrypt deps Instead of iterating over fifteen packages with a loop that does fifteen separate apt transactions, it is better to give the apt module a list so it can install them all in one transaction. This is both quicker and te- chnically more safe for dependency resolution.
2018-04-25 19:02:42 +02:00
apt: name={{ letsencrypt_debian_stretch_deps }} state=present update_cache=yes
tags:
- packages
- letsencrypt
roles/nginx: Add package deps for Let's Encrypt on Debian 9 Taken from running certbot-auto on a clean Debian 9 installation.
2017-02-16 17:15:06 +01:00
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt.
2016-06-27 22:52:39 +02:00
# vim: set ts=2 sw=2: