mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 03:04:30 +00:00
86990af9c8
- New acme role: installs acme.sh, issues certs for myrddin/merlin/gandalf via DNS-01 (name.com API), installs cert files to /etc/ssl/certs/prole/, sets up renewal cron. rc=2 (already valid) treated as ok. - New playbooks/acme.yml: runs acme role on myrddin (issues all 3 host certs) - New playbooks/certmgr.yml: cert-manager and letsencrypt-prod ClusterIssuer (HTTP-01/Traefik) for external endpoints (db/svc/api.prole.org) - Add vault references for name.com API creds to group_vars/all/vars.yml - Add prole_ssl_src_dir and prole_ssl_files to myrddin/merlin/gandalf host_vars Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
86 lines
2.6 KiB
YAML
86 lines
2.6 KiB
YAML
---
|
|
- name: Ensure /etc/ssl/certs/prole exists
|
|
ansible.builtin.file:
|
|
path: /etc/ssl/certs/prole
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
|
|
- name: Ensure git is installed (required for acme.sh clone)
|
|
ansible.builtin.apt:
|
|
name: git
|
|
state: present
|
|
|
|
- name: Check if acme.sh is already installed
|
|
ansible.builtin.stat:
|
|
path: "{{ acme_install_dir }}/acme.sh"
|
|
register: acme_sh_stat
|
|
|
|
- name: Clone acme.sh
|
|
ansible.builtin.git:
|
|
repo: https://github.com/acmesh-official/acme.sh.git
|
|
dest: /tmp/acme.sh-src
|
|
depth: 1
|
|
when: not acme_sh_stat.stat.exists
|
|
|
|
- name: Install acme.sh
|
|
ansible.builtin.command: >-
|
|
./acme.sh --install
|
|
--home {{ acme_install_dir }}
|
|
--accountemail {{ acme_email }}
|
|
--nocron
|
|
args:
|
|
chdir: /tmp/acme.sh-src
|
|
creates: "{{ acme_install_dir }}/acme.sh"
|
|
when: not acme_sh_stat.stat.exists
|
|
|
|
- name: Set default CA to Let's Encrypt
|
|
ansible.builtin.command: "{{ acme_install_dir }}/acme.sh --set-default-ca --server letsencrypt"
|
|
changed_when: false
|
|
|
|
- name: Check existing cert status
|
|
ansible.builtin.command: "{{ acme_install_dir }}/acme.sh --list"
|
|
register: acme_list
|
|
changed_when: false
|
|
|
|
- name: Issue certs via DNS-01 (name.com) — skip if already issued
|
|
ansible.builtin.command: >-
|
|
{{ acme_install_dir }}/acme.sh --issue
|
|
--dns dns_namecom
|
|
-d {{ item.domain }}
|
|
--home {{ acme_install_dir }}
|
|
environment:
|
|
NAMECOM_Username: "{{ acme_namecom_username }}"
|
|
NAMECOM_Token: "{{ acme_namecom_token }}"
|
|
loop: "{{ acme_certs }}"
|
|
register: acme_issue
|
|
changed_when: "'Cert success' in acme_issue.stdout"
|
|
# rc=2 means cert already exists and is not due for renewal — treat as ok
|
|
failed_when: acme_issue.rc not in [0, 2]
|
|
when: item.domain not in acme_list.stdout
|
|
|
|
- name: Install cert files to target paths
|
|
ansible.builtin.command: >-
|
|
{{ acme_install_dir }}/acme.sh --install-cert
|
|
-d {{ item.domain }}
|
|
--home {{ acme_install_dir }}
|
|
--fullchain-file {{ (item.install | selectattr('src', 'equalto', 'fullchain.cer') | first).dest }}
|
|
--key-file {{ (item.install | selectattr('src', 'match', '.*\\.key$') | first).dest }}
|
|
loop: "{{ acme_certs }}"
|
|
notify: reload prole ssl consumers
|
|
|
|
- name: Fix permissions on installed cert files
|
|
ansible.builtin.file:
|
|
path: "{{ file_item.dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "{{ '0600' if file_item.dest.endswith('.key') else '0644' }}"
|
|
loop: "{{ acme_certs | map(attribute='install') | flatten }}"
|
|
loop_control:
|
|
loop_var: file_item
|
|
|
|
- name: Install acme.sh renewal cron
|
|
ansible.builtin.command: "{{ acme_install_dir }}/acme.sh --install-cronjob"
|
|
changed_when: false
|