Dustin C. Hatch
6d1442faf0
The *lego-nginx* role automates obtaining certificates for *nginx* via ACME using `lego`. It generates a shell script with the appropriate arguments for `lego run`, runs it once to obtain a certificate initially, then schedules it to run periodically via a systemd timer unit. Using `lego`'s "hook" capability, the script signals the `nginx` server process to reload. This uses `doas` for now, but could be adapted easily to use `sudo`, if the need ever arises.
51 lines
1.1 KiB
YAML
51 lines
1.1 KiB
YAML
# vim: set ft=yaml.jinja :
|
|
- name: ensure lego webroot exists
|
|
file:
|
|
path: /var/www/lego
|
|
owner: lego
|
|
group: lego
|
|
mode: u=rwx,go=rx
|
|
setype: httpd_sys_content_t
|
|
state: directory
|
|
tags:
|
|
- webroot
|
|
|
|
- name: ensure lego is allowed to reload nginx
|
|
lineinfile:
|
|
dest: /etc/doas.conf
|
|
line: permit nopass lego cmd /usr/sbin/nginx args -s reload
|
|
tags:
|
|
- doas
|
|
|
|
- name: ensure lego renew script exists
|
|
copy:
|
|
content: >+
|
|
lego
|
|
--path /var/lib/lego
|
|
--accept-tos
|
|
{% if lego_acme_server %}
|
|
--server {{ lego_acme_server }}
|
|
{% endif %}
|
|
--http --http.webroot /var/www/lego
|
|
{% for domain in lego_domains %}
|
|
--domains {{ domain }}
|
|
{% endfor %}
|
|
--email {{ lego_acme_email }}
|
|
run
|
|
--run-hook 'doas /usr/sbin/nginx -s reload'
|
|
dest: /var/lib/lego/renew.sh
|
|
owner: lego
|
|
group: lego
|
|
mode: u=rwx,go=rx
|
|
tags:
|
|
- lego-renew
|
|
|
|
- name: ensure server certificate exists
|
|
become: true
|
|
become_user: lego
|
|
command: /bin/sh /var/lib/lego/renew.sh
|
|
args:
|
|
creates: /var/lib/lego/certificates/{{ lego_domains[0] }}.json
|
|
tags:
|
|
- cert
|