---
|
## Request Let's Encrypt Certificates for a host
|
- name: Set Certbot directory
|
set_fact:
|
_certbot_dir: "{{ _certbot_remote_dir }}/certbot"
|
|
- name: Check on AWS credentials
|
when: _certbot_dns_provider is match('route53')
|
block:
|
- name: Verify if AWS Credentials exist on the host
|
stat:
|
path: "/home/{{ ansible_user }}/.aws/credentials"
|
register: aws_credentials_result
|
|
- name: Fail if AWS Credentials are not on the host
|
fail:
|
msg: AWS Credentials are required when requesting certificates for a wildcard domain
|
when: aws_credentials_result.stat.exists == False
|
|
- name: Check on DDNS credentials
|
when: _certbot_dns_provider is match('rfc2136')
|
block:
|
- name: Verify credential are present on host
|
when: _certbot_dns_provider is match('rfc2136')
|
stat:
|
path: /home/{{ _certbot_user }}/.rfc2136.ini
|
register: ddns_credentials_result
|
|
- name: Fail if DDNS credentials are missing
|
fail:
|
msg: You need a key and secret to update DNS
|
when: ddns_credentials_result.stat.exists == False
|
|
- name: Set _certbot_wildcard_certs fact
|
set_fact:
|
_certbot_wildcard_certs: "{{ (_certbot_wildcard_domain|length|int>0)|ternary('true','false') }}"
|
|
- name: Test if Let's Encrypt Certificates are already there
|
stat:
|
path: "{{ _certbot_install_dir }}/fullchain.pem"
|
register: cacert
|
|
- name: No Certificates on host or _certbot_force_issue=true -> set up Let's Encrypt Certificates
|
when:
|
- cacert.stat.exists|bool == false or _certbot_force_issue|bool
|
block:
|
# We expect Python3 and Python3-pip to be installed
|
# They should be on the bastion that this role is running
|
|
# The requirements_certbot.txt file has the Python modules
|
# For certbot, certbot-dns-route53 and certbot-dns-rfc2136
|
- name: Copy requirements_certbot.txt to target for certbot virtualenv
|
copy:
|
src: ./files/requirements_certbot.txt
|
dest: /tmp/requirements_certbot.txt
|
|
# The next two commands need to be run as _certbot_user in order to set up the correct permissions
|
# Running without will create links to /root/.local/... which won't be readable
|
- name: Create Virtualenv Certbot
|
become: True
|
become_user: "{{ _certbot_user }}"
|
command: "/usr/local/bin/virtualenv -p /usr/bin/python3 {{ _certbot_virtualenv }}"
|
|
- name: Install Certbot into Virtualenv
|
become: true
|
become_user: "{{ _certbot_user }}"
|
command: "{{ _certbot_virtualenv }}/bin/pip3 install -r /tmp/requirements_certbot.txt"
|
|
- name: Copy certbot script to virtualenv
|
template:
|
src: ./templates/run-certbot.j2
|
dest: "{{ _certbot_virtualenv }}/bin/run-certbot"
|
owner: "{{ _certbot_user }}"
|
mode: 0755
|
|
- name: Check if cached certificate archive exists
|
become: false
|
stat:
|
path: "{{ _certbot_cache_archive_file }}"
|
delegate_to: localhost
|
register: cache_archive_file
|
|
- name: Ensure Certbot Directories are present
|
file:
|
name: "{{ item }}"
|
state: directory
|
owner: "{{ _certbot_remote_dir_owner }}"
|
mode: 0775
|
loop:
|
- "{{ _certbot_dir }}"
|
- "{{ _certbot_dir }}/config"
|
- "{{ _certbot_dir }}/work"
|
- "{{ _certbot_dir }}/logs"
|
|
- name: Restore entire certificate archive
|
when:
|
- _certbot_use_cache|bool
|
- cache_archive_file.stat.exists|bool
|
- not _certbot_force_issue|bool
|
block:
|
- name: Upload certificate archive
|
unarchive:
|
src: "{{ _certbot_cache_archive_file }}"
|
dest: "{{ _certbot_remote_dir }}"
|
owner: "{{ _certbot_install_dir_owner }}"
|
keep_newer: yes
|
- name: Set _certbot_setup_complete=true
|
set_fact:
|
_certbot_setup_complete: true
|
|
- name: Request Certificates from Let's Encrypt (force or no cache)
|
when:
|
- _certbot_force_issue|bool or not _certbot_setup_complete|bool
|
block:
|
# Get Intermediary CA Certificate.
|
# This is also used in the SSO configuration!
|
- name: Get Let's Encrypt Intermediary CA Certificate
|
get_url:
|
url: https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt
|
dest: "{{ _certbot_dir }}/lets-encrypt-x3-cross-signed.pem"
|
- name: Print Shell Command
|
debug:
|
msg: >-
|
About to request certificates using the following command:
|
certbot certonly -n --agree-tos --email {{ _certbot_le_email }}
|
-d {{ _certbot_domain }}
|
{{ (_certbot_wildcard_domain|length>0)|ternary('-d','')}} {{ (_certbot_wildcard_domain|length>0)|ternary(_certbot_wildcard_domain,'')}}
|
{{ (_certbot_wildcard_certs|bool)|ternary('--dns-'+_certbot_dns_provider, '') }}
|
--config-dir={{ _certbot_dir }}/config
|
--work-dir={{ _certbot_dir }}/work
|
--logs-dir={{ _certbot_dir }}/logs
|
{{ (_certbot_production|bool)|ternary('','--test-cert') }}
|
{{ _certbot_additional_args|d(_certbot_args)|d('') }}
|
|
- name: Request API and Wildcard Certificates
|
# become: false
|
become_user: "{{ _certbot_user }} "
|
command: "{{ _certbot_virtualenv }}/bin/run-certbot"
|
retries: 5
|
delay: 30
|
register: r_request_le
|
until: r_request_le is succeeded
|
|
- name: Save certificates to cache
|
when:
|
- _certbot_use_cache|bool
|
- _certbot_cache_archive_file is defined
|
- _certbot_cache_archive_file|trim != ""
|
block:
|
- name: Create archive of certbot directory for cache
|
archive:
|
path: "{{ _certbot_dir }}"
|
dest: "/tmp/certbot.tgz"
|
- name: Save certbot archive to cache
|
fetch:
|
src: "/tmp/certbot.tgz"
|
dest: "{{ _certbot_cache_archive_file }}"
|
flat: yes
|
- name: Remove archive from server
|
file:
|
name: "/tmp/certbot.tgz"
|
state: absent
|
|
- name: Install the certificates into {{ _certbot_install_dir }}
|
block:
|
- name: Ensure {{ _certbot_install_dir }} exists
|
file:
|
path: "{{ _certbot_install_dir }}"
|
state: directory
|
owner: "{{ _certbot_install_dir_owner }}"
|
mode: 0775
|
|
- name: Install certificates
|
copy:
|
src: "{{ _certbot_dir }}/config/live/{{ _certbot_domain }}/{{ item }}"
|
dest: "{{ _certbot_install_dir }}/{{ item }}"
|
remote_src: yes
|
loop:
|
- "cert.pem"
|
- "fullchain.pem"
|
- "chain.pem"
|
- "privkey.pem"
|
|
- name: Set _certbot_setup_complete to true
|
set_fact:
|
_certbot_setup_complete: true
|
|
- name: Install Automatic renewals of Certificates
|
when:
|
- _certbot_renew_automatically|bool
|
block:
|
- name: Install crontab to renew certificates when they expire
|
become: False
|
cron:
|
name: "{{ _certbot_cron_job_name }}"
|
special_time: daily
|
job: "certbot renew {{ _certbot_additional_args|d(_certbot_args)|d('') }} --config-dir={{ _certbot_dir }}/config --work-dir={{ _certbot_dir }}/work --logs-dir={{ _certbot_dir }}/logs --quiet > /dev/null"
|
