๐Ÿ“— Ansible playbooks and roles for building an idempotent, interconnected and scalable infrastructure
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
ansible-playbooks/roles/caddy/tasks/setup_lego.yml

158 lines
4.3 KiB

- name: determine host architecture
include_tasks: tasks/get_host_arch.yml
- name: create lego working dir
file:
path: "{{ caddy_lego_dir }}"
state: directory
mode: 0700
owner: "{{ caddy_user }}"
group: "{{ caddy_group }}"
- name: get and extract latest lego version
include_tasks: tasks/get_lastversion.yml
vars:
package:
name: go-acme/lego
location: github
assets: yes
asset_filter: "{{ 'linux_' ~ host_architecture ~ '.tar.gz$' }}"
file: "{{ caddy_lego_dir }}/last_version"
extract: "{{ caddy_lego_dir }}"
user: "{{ caddy_user }}"
group: "{{ caddy_group }}"
- block:
- name: remove unnecessary files
file:
path: "{{ (caddy_lego_dir, item) | path_join }}"
state: absent
loop:
- LICENSE
- CHANGELOG.md
rescue:
- meta: noop
- name: set lego parameters
set_fact:
lego_params: "{{
[
([] | zip_longest(caddy_domains | d([]) | select() | map('quote'), fillvalue='--domains ') | map('join') | list),
'--server ' ~ (acme_endpoint | quote),
'--accept-tos',
'--email ' ~ (acme_email | quote),
'--key-type ec384',
'--path ' ~ (caddy_lego_dir | quote),
'--dns acme-dns',
'--dns.resolvers 9.9.9.9',
'--dns.disable-cp'
] | flatten(levels=1) | select() | list | join(' ') }}"
lego_renewal_params: "{{
[
(('--days ' ~ (acme_renewal_days | quote)) if acme_renewal_days is defined else ''),
('--reuse-key' if acme_reuse_key | d(false) == true else ''),
('--no-random-sleep' if acme_no_random_sleep | d(true) == true else '')
] | flatten(levels=1) | select() | list | join(' ') }}"
lego_preferred_chain: "{{ '--preferred-chain ' ~ (acme_preferred_chain | quote) if acme_preferred_chain is defined else '' }}"
- name: check if lastrun file exists
stat:
path: "{{ caddy_lego_lastrun_file }}"
get_checksum: no
get_mime: no
register: result
- name: set initial reissue value
set_fact:
lego_must_reissue: yes
lego_full_command: "{{ (caddy_lego_dir, 'lego') | path_join }} {{ lego_params }} run {{ lego_preferred_chain }}"
lego_renew_command: "{{ (caddy_lego_dir, 'lego') | path_join }} {{ lego_params }} renew {{ lego_preferred_chain }} {{ lego_renewal_params }}"
- block:
- name: get lastrun file contents
slurp:
path: "{{ caddy_lego_lastrun_file }}"
register: file_content
no_log: yes
- name: set acme-dns-client domain fact
set_fact:
lego_must_reissue: "{{ (file_content.content | b64decode) != lego_full_command }}"
when: result.stat.exists
- block:
- name: issue cert with dns mode
shell:
cmd: "{{ lego_full_command }}"
chdir: "{{ caddy_lego_dir }}"
environment:
ACME_DNS_API_BASE: "{{ acme_dns_server }}"
ACME_DNS_STORAGE_PATH: "{{ (caddy_lego_dir, 'accounts.conf') | path_join }}"
register: result
become: yes
become_method: "{{ 'su' if ansible_distribution == 'Alpine' else 'sudo' }}"
become_user: "{{ caddy_user }}"
when: lego_must_reissue
rescue:
- pause:
- name: retry issuing cert with dns mode
shell:
cmd: "{{ lego_full_command }}"
chdir: "{{ caddy_lego_dir }}"
environment:
ACME_DNS_API_BASE: "{{ acme_dns_server }}"
ACME_DNS_STORAGE_PATH: "{{ (caddy_lego_dir, 'accounts.conf') | path_join }}"
register: result
become: yes
become_method: "{{ 'su' if ansible_distribution == 'Alpine' else 'sudo' }}"
become_user: "{{ caddy_user }}"
- block:
- name: save data to lastrun file
copy:
content: "{{ lego_full_command }}"
dest: "{{ caddy_lego_lastrun_file }}"
remote_src: yes
- name: defer caddy restart
debug:
msg: deferring caddy restart
changed_when: yes
notify: restart caddy
when: lego_must_reissue
- name: template systemd files
template:
src: "{{ item.src }}.j2"
dest: "/etc/systemd/system/{{ item.dst }}"
force: yes
lstrip_blocks: yes
loop:
- { src: 'lego_systemd', dst: 'lego.service' }
- { src: 'lego_timer', dst: 'lego.timer' }
notify: reload systemd daemons
- name: enable lego timer
systemd:
name: lego.timer
state: started
enabled: yes
# TODO: restart script