| commit | author | age | ||
| caefa6 | 1 | --- |
| WK | 2 | ## Request Let's Encrypt Certificates for a host |
| 3 | - name: Set Certbot directory | |
| 4 | set_fact: | |
| 5 | _certbot_dir: "{{ _certbot_remote_dir }}/certbot" | |
| 6 | ||
| 2f745d | 7 | - name: Check on AWS credentials |
| caefa6 | 8 | when: _certbot_dns_provider is match('route53') |
| 2f745d | 9 | block: |
| NS | 10 | - name: Verify if AWS Credentials exist on the host |
| 11 | stat: | |
| 12 | path: "/home/{{ ansible_user }}/.aws/credentials" | |
| 13 | register: aws_credentials_result | |
| 14 | ||
| 15 | - name: Fail if AWS Credentials are not on the host | |
| 16 | fail: | |
| 17 | msg: AWS Credentials are required when requesting certificates for a wildcard domain | |
| 18 | when: aws_credentials_result.stat.exists == False | |
| caefa6 | 19 | |
| 2f745d | 20 | - name: Check on DDNS credentials |
| NS | 21 | when: _certbot_dns_provider is match('rfc2136') |
| 22 | block: | |
| 23 | - name: Verify credential are present on host | |
| 24 | when: _certbot_dns_provider is match('rfc2136') | |
| 25 | stat: | |
| 26 | path: /home/{{ _certbot_user }}/.rfc2136.ini | |
| 27 | register: ddns_credentials_result | |
| 28 | ||
| 29 | - name: Fail if DDNS credentials are missing | |
| 30 | fail: | |
| 31 | msg: You need a key and secret to update DNS | |
| 32 | when: ddns_credentials_result.stat.exists == False | |
| caefa6 | 33 | |
| WK | 34 | - name: Set _certbot_wildcard_certs fact |
| 5b4c35 | 35 | set_fact: |
| caefa6 | 36 | _certbot_wildcard_certs: "{{ (_certbot_wildcard_domain|length|int>0)|ternary('true','false') }}" |
| WK | 37 | |
| 38 | - name: Test if Let's Encrypt Certificates are already there | |
| 39 | stat: | |
| 40 | path: "{{ _certbot_install_dir }}/fullchain.pem" | |
| 41 | register: cacert | |
| 42 | ||
| 43 | - name: No Certificates on host or _certbot_force_issue=true -> set up Let's Encrypt Certificates | |
| 44 | when: | |
| 45 | - cacert.stat.exists|bool == false or _certbot_force_issue|bool | |
| 46 | block: | |
| 0b1859 | 47 | # We expect Python3 and Python3-pip to be installed |
| WK | 48 | # They should be on the bastion that this role is running |
| 816b92 | 49 | |
| 0b1859 | 50 | # The requirements_certbot.txt file has the Python modules |
| WK | 51 | # For certbot, certbot-dns-route53 and certbot-dns-rfc2136 |
| 52 | - name: Copy requirements_certbot.txt to target for certbot virtualenv | |
| 53 | copy: | |
| 54 | src: ./files/requirements_certbot.txt | |
| 55 | dest: /tmp/requirements_certbot.txt | |
| 5b4c35 | 56 | |
| 0b1859 | 57 | # The next two commands need to be run as _certbot_user in order to set up the correct permissions |
| WK | 58 | # Running without will create links to /root/.local/... which won't be readable |
| 59 | - name: Create Virtualenv Certbot | |
| 7b32c1 | 60 | become: True |
| 0b1859 | 61 | become_user: "{{ _certbot_user }}" |
| WK | 62 | command: "/usr/local/bin/virtualenv -p /usr/bin/python3 {{ _certbot_virtualenv }}" |
| 63 | ||
| 64 | - name: Install Certbot into Virtualenv | |
| 65 | become: true | |
| 66 | become_user: "{{ _certbot_user }}" | |
| 67 | command: "{{ _certbot_virtualenv }}/bin/pip3 install -r /tmp/requirements_certbot.txt" | |
| 68 | ||
| 69 | - name: Copy certbot script to virtualenv | |
| 7b32c1 | 70 | template: |
| WK | 71 | src: ./templates/run-certbot.j2 |
| 0b1859 | 72 | dest: "{{ _certbot_virtualenv }}/bin/run-certbot" |
| 7b32c1 | 73 | owner: "{{ _certbot_user }}" |
| WK | 74 | mode: 0755 |
| caefa6 | 75 | |
| 7b32c1 | 76 | - name: Check if cached certificate archive exists |
| WK | 77 | become: false |
| 78 | stat: | |
| 79 | path: "{{ _certbot_cache_archive_file }}" | |
| 80 | delegate_to: localhost | |
| 81 | register: cache_archive_file | |
| caefa6 | 82 | |
| 7b32c1 | 83 | - name: Restore entire certificate archive |
| WK | 84 | when: |
| 85 | - _certbot_use_cache|bool | |
| 86 | - cache_archive_file.stat.exists|bool | |
| 87 | - not _certbot_force_issue|bool | |
| 88 | block: | |
| 89 | - name: Upload certificate archive | |
| 90 | unarchive: | |
| 91 | src: "{{ _certbot_cache_archive_file }}" | |
| 92 | dest: "{{ _certbot_remote_dir }}" | |
| 93 | owner: "{{ _certbot_install_dir_owner }}" | |
| 94 | keep_newer: yes | |
| 95 | - name: Set _certbot_setup_complete=true | |
| 96 | set_fact: | |
| 97 | _certbot_setup_complete: true | |
| 98 | ||
| 99 | - name: Ensure Certbot Directories are present | |
| 100 | file: | |
| 101 | name: "{{ item }}" | |
| 102 | state: directory | |
| 103 | owner: "{{ _certbot_remote_dir_owner }}" | |
| 104 | mode: 0775 | |
| 105 | loop: | |
| 106 | - "{{ _certbot_dir }}" | |
| 107 | - "{{ _certbot_dir }}/config" | |
| 108 | - "{{ _certbot_dir }}/work" | |
| 109 | - "{{ _certbot_dir }}/logs" | |
| 110 | - "{{ _certbot_dir }}/renewal-hooks" | |
| 111 | - "{{ _certbot_dir }}/renewal-hooks/deploy" | |
| 112 | ||
| 113 | - name: Request Certificates from Let's Encrypt (force or no cache) | |
| 114 | when: | |
| 115 | - _certbot_force_issue|bool or not _certbot_setup_complete|bool | |
| 116 | block: | |
| 117 | # Get Intermediary CA Certificate. | |
| 118 | # This is also used in the SSO configuration! | |
| 119 | - name: Get Let's Encrypt Intermediary CA Certificate | |
| 120 | get_url: | |
| 121 | url: https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt | |
| 122 | dest: "{{ _certbot_dir }}/lets-encrypt-x3-cross-signed.pem" | |
| 123 | - name: Print Shell Command | |
| 124 | debug: | |
| 125 | msg: >- | |
| 126 | About to request certificates using the following command: | |
| 127 | certbot certonly -n --agree-tos --email {{ _certbot_le_email }} | |
| 128 | -d {{ _certbot_domain }} | |
| 129 | {{ (_certbot_wildcard_domain|length>0)|ternary('-d','')}} {{ (_certbot_wildcard_domain|length>0)|ternary(_certbot_wildcard_domain,'')}} | |
| 130 | {{ (_certbot_wildcard_certs|bool)|ternary('--dns-'+_certbot_dns_provider, '') }} | |
| 131 | --config-dir={{ _certbot_dir }}/config | |
| 132 | --work-dir={{ _certbot_dir }}/work | |
| 133 | --logs-dir={{ _certbot_dir }}/logs | |
| 134 | {{ (_certbot_production|bool)|ternary('','--test-cert') }} | |
| 135 | {{ _certbot_additional_args|d(_certbot_args)|d('') }} | |
| 136 | ||
| 137 | - name: Request API and Wildcard Certificates | |
| 138 | # become: false | |
| 139 | become_user: "{{ _certbot_user }} " | |
| 0b1859 | 140 | command: "{{ _certbot_virtualenv }}/bin/run-certbot" |
| 7b32c1 | 141 | retries: 5 |
| WK | 142 | delay: 30 |
| 143 | register: r_request_le | |
| 144 | until: r_request_le is succeeded | |
| 145 | ||
| 146 | - name: Save certificates to cache | |
| caefa6 | 147 | when: |
| WK | 148 | - _certbot_use_cache|bool |
| 7b32c1 | 149 | - _certbot_cache_archive_file is defined |
| WK | 150 | - _certbot_cache_archive_file|trim != "" |
| caefa6 | 151 | block: |
| 7b32c1 | 152 | - name: Create archive of certbot directory for cache |
| WK | 153 | archive: |
| 154 | path: "{{ _certbot_dir }}" | |
| 155 | dest: "/tmp/certbot.tgz" | |
| 156 | - name: Save certbot archive to cache | |
| 157 | fetch: | |
| 158 | src: "/tmp/certbot.tgz" | |
| 159 | dest: "{{ _certbot_cache_archive_file }}" | |
| 160 | flat: yes | |
| 161 | - name: Remove archive from server | |
| 162 | file: | |
| 163 | name: "/tmp/certbot.tgz" | |
| 164 | state: absent | |
| caefa6 | 165 | |
| WK | 166 | - name: Install the certificates into {{ _certbot_install_dir }} |
| 167 | block: | |
| 168 | - name: Ensure {{ _certbot_install_dir }} exists | |
| 169 | file: | |
| 170 | path: "{{ _certbot_install_dir }}" | |
| 171 | state: directory | |
| 172 | owner: "{{ _certbot_install_dir_owner }}" | |
| 173 | mode: 0775 | |
| 2f745d | 174 | |
| caefa6 | 175 | - name: Install certificates |
| WK | 176 | copy: |
| 177 | src: "{{ _certbot_dir }}/config/live/{{ _certbot_domain }}/{{ item }}" | |
| 178 | dest: "{{ _certbot_install_dir }}/{{ item }}" | |
| 179 | remote_src: yes | |
| 180 | loop: | |
| 181 | - "cert.pem" | |
| 182 | - "fullchain.pem" | |
| 183 | - "chain.pem" | |
| 184 | - "privkey.pem" | |
| 185 | ||
| 2f745d | 186 | - name: Set _certbot_setup_complete to true |
| NS | 187 | set_fact: |
| 188 | _certbot_setup_complete: true | |
| 189 | ||
| e3cb5c | 190 | - name: Install Automatic renewals of Certificates |
| WK | 191 | when: |
| 192 | - _certbot_renew_automatically|bool | |
| 193 | block: | |
| 194 | - name: Install crontab to renew certificates when they expire | |
| 195 | become: False | |
| 196 | cron: | |
| 0d0d0e | 197 | name: "{{ _certbot_cron_job_name }}" |
| e3cb5c | 198 | special_time: daily |
| WK | 199 | job: "certbot renew {{ _certbot_additional_args|d(_certbot_args)|d('') }} --config-dir={{ _certbot_dir }}/config --work-dir={{ _certbot_dir }}/work --logs-dir={{ _certbot_dir }}/logs --quiet > /dev/null" |
