ssl.yml 3.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100
  1. - name: 'Create ssl certificates directory for in /etc/ssl'
  2. file:
  3. path: '/etc/ssl/local/certs/{{ item }}'
  4. state: 'directory'
  5. owner: 'root'
  6. group: 'root'
  7. mode: '0755'
  8. with_items: '{{ ssl_certs }}'
  9. - name: 'Install ssl certificates (certificate)'
  10. copy:
  11. content: "{{lookup('file', 'data/ssl/' + item + '/' + item + '.crt')}}"
  12. dest: '/etc/ssl/local/certs/{{ item }}/cert.pem'
  13. owner: 'root'
  14. group: 'root'
  15. mode: '0640'
  16. register: ssl_cert_result
  17. with_items: '{{ ssl_certs }}'
  18. - name: 'Install ssl certificates (private key)'
  19. copy:
  20. content: "{{lookup('file', 'data/ssl/' + item + '/' + item + '.key')}}"
  21. dest: '/etc/ssl/local/certs/{{ item }}/privkey.pem'
  22. owner: 'root'
  23. group: 'root'
  24. mode: '0640'
  25. register: ssl_key_result
  26. with_items: '{{ ssl_certs }}'
  27. - name: 'Install ssl certificates (chain)'
  28. copy:
  29. content: "{{lookup('file', 'data/ssl/' + item + '/bundle.crt')}}"
  30. dest: '/etc/ssl/local/certs/{{ item }}/chain.pem'
  31. owner: 'root'
  32. group: 'root'
  33. mode: '0644'
  34. register: ssl_chain_result
  35. with_items: '{{ ssl_certs }}'
  36. - name: 'Gathering info about ssl full chain (certificate + chain)'
  37. stat:
  38. path: '/etc/ssl/local/certs/{{ item }}/fullchain.pem'
  39. with_items: '{{ ssl_certs }}'
  40. register: ssl_fullchain_stats
  41. - name: 'Gathering info about ssl bundle (key + fullchain)'
  42. stat:
  43. path: '/etc/ssl/local/certs/{{ item }}/bundle.pem'
  44. with_items: '{{ ssl_certs }}'
  45. register: ssl_bundle_stats
  46. - name: 'Create ssl certificates full chain (certificate + chain)'
  47. shell: sed '/^\s*$/d' '/etc/ssl/local/certs/{{ item.item }}/cert.pem' '/etc/ssl/local/certs/{{ item.item }}/chain.pem' > '/etc/ssl/local/certs/{{ item.item }}/fullchain.pem'
  48. with_items: '{{ ssl_fullchain_stats.results }}'
  49. when: not item.stat.exists or ssl_cert_result|changed or ssl_chain_result|changed
  50. - name: 'Create ssl certificates bundle (key + certificate + bundle)'
  51. shell: sed '/^\s*$/d' '/etc/ssl/local/certs/{{ item.item }}/privkey.pem' '/etc/ssl/local/certs/{{ item.item }}/cert.pem' '/etc/ssl/local/certs/{{ item.item }}/chain.pem' > '/etc/ssl/local/certs/{{ item.item }}/bundle.pem'
  52. with_items: '{{ ssl_bundle_stats.results }}'
  53. when: not item.stat.exists or ssl_key_result|changed or ssl_cert_result|changed or ssl_chain_result|changed
  54. - name: 'Install Lets Encrypt client'
  55. apt:
  56. pkg: 'dehydrated'
  57. state: 'installed'
  58. when: ssl_certs_auto
  59. - name: 'Install Lets Encrypt domains configuration'
  60. template:
  61. src: 'ssl/letsencrypt_domains.j2'
  62. dest: '/etc/dehydrated/domains.txt'
  63. owner: 'root'
  64. group: 'root'
  65. mode: '0644'
  66. when: ssl_certs_auto
  67. - name: 'List Lets Encrypt SSL installed certificates'
  68. shell: find /var/lib/dehydrated/certs -iname privkey.pem | cut -d / -f6
  69. register: ssl_certs_auto_installed
  70. changed_when: False
  71. ignore_errors: True
  72. when: ssl_certs_auto
  73. - name: 'List Lets Encrypt SSL certificates to be generated'
  74. shell: egrep -v '^#' /etc/dehydrated/domains.txt | while read c ; do test -f "/var/lib/dehydrated/certs/${c}/privkey.pem" || echo "${c}" ; done
  75. register: ssl_certs_auto_missing
  76. ignore_errors: True
  77. changed_when: ssl_certs_auto_missing.stdout_lines != []
  78. notify:
  79. - 'Generate Lets Encrypt SSL certificates'
  80. when: ssl_certs_auto
  81. - name: 'Install Lets Encrypt cron job'
  82. template:
  83. src: 'cron/letsencrypt.j2'
  84. dest: '/etc/cron.d/letsencrypt-local'
  85. owner: 'root'
  86. group: 'root'
  87. mode: '0644'
  88. when: ssl_certs_auto