ansible-personal/roles/nginx/tasks/tls_vhosts.yml
Alan Orth 59b9bd70b8 roles/nginx: Ingenius use of YAML hashes to derive TLS key from another file
This is kinda crazy, but makes the host_vars much easier to read.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-10-11 15:42:44 +03:00

38 lines
1.3 KiB
YAML

---
- name: Configure https vhosts
template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.nginx_domain_name }}.conf mode=0644 owner=root group=root
with_items: nginx_tls_vhosts
notify:
- reload nginx
# Chained TLS keys for all domains in one file, like:
#
# domain.com:
# tls_cert: |
# -----BEGIN PRIVATE KEY-----
# MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDeIotVB7/WY9sJ
- name: Get TLS certs
include_vars: "../../../vars/tls_keys.yml"
# Loop through tls vhosts and derive var to pull cert from (see above)
#
# concatenated key + cert, can live in the same file
# See: http://nginx.org/en/docs/http/configuring_https_servers.html
- name: Copy TLS certs
copy: { dest: "{{ tls_key_dir }}/{{ item.nginx_domain_name }}.crt.pem", content: "{{ {{ item.nginx_domain_name }}.{{ tls_cert }} }}", mode: 0700, owner: 'root', group: 'root' }
with_items: nginx_tls_vhosts
notify:
- reload nginx
- name: Generate 2048-bit dhparam
command: openssl dhparam -out dhparam.pem 2048 chdir=/etc/ssl/certs creates=dhparam.pem
notify:
- reload nginx
- name: Create vhost document roots
file: path={{ nginx_root_prefix }}/{{ item.nginx_domain_name }} state=directory mode=0755 owner=nginx group=nginx
with_items: nginx_tls_vhosts
# vim: set ts=2 sw=2: