Dustin C. Hatch
6d1442faf0
The *lego-nginx* role automates obtaining certificates for *nginx* via ACME using `lego`. It generates a shell script with the appropriate arguments for `lego run`, runs it once to obtain a certificate initially, then schedules it to run periodically via a systemd timer unit. Using `lego`'s "hook" capability, the script signals the `nginx` server process to reload. This uses `doas` for now, but could be adapted easily to use `sudo`, if the need ever arises.
67 lines
1.3 KiB
YAML
67 lines
1.3 KiB
YAML
- name: load os-specific values
|
|
include_vars: '{{ item }}'
|
|
with_first_found:
|
|
- '{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml'
|
|
- '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml'
|
|
- '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml'
|
|
- '{{ ansible_distribution }}.yml'
|
|
- '{{ ansible_os_family }}.yml'
|
|
- defaults.yml
|
|
tags:
|
|
- always
|
|
|
|
- name: ensure lego is installed
|
|
package:
|
|
name:
|
|
- acl # required for `become_user: lego`
|
|
- '{{ lego_package }}'
|
|
state: present
|
|
tags:
|
|
- install
|
|
|
|
- name: ensure lego group exists
|
|
group:
|
|
name: lego
|
|
system: true
|
|
tags:
|
|
- user
|
|
- group
|
|
- name: ensure lego user exists
|
|
user:
|
|
name: lego
|
|
group: lego
|
|
system: true
|
|
home: /var/lib/lego
|
|
createhome: true
|
|
shell: /bin/false
|
|
tags:
|
|
- user
|
|
|
|
- name: ensure lego-renew systemd units are installed
|
|
copy:
|
|
src: '{{ item }}'
|
|
dest: /etc/systemd/system/
|
|
owner: root
|
|
group: root
|
|
mode: u=rw,go=r
|
|
loop:
|
|
- lego-renew.service
|
|
- lego-renew.timer
|
|
notify:
|
|
- reload systemd
|
|
tags:
|
|
- systemd
|
|
|
|
- name: ensure lego-renew systemd timer is enabled
|
|
systemd:
|
|
name: lego-renew.timer
|
|
enabled: true
|
|
tags:
|
|
- service
|
|
- name: ensure lego-renew systemd timer is running
|
|
systemd:
|
|
name: lego-renew.timer
|
|
state: started
|
|
tags:
|
|
- service
|