Dustin C. Hatch
6d1442faf0
The *lego-nginx* role automates obtaining certificates for *nginx* via ACME using `lego`. It generates a shell script with the appropriate arguments for `lego run`, runs it once to obtain a certificate initially, then schedules it to run periodically via a systemd timer unit. Using `lego`'s "hook" capability, the script signals the `nginx` server process to reload. This uses `doas` for now, but could be adapted easily to use `sudo`, if the need ever arises.
38 lines
650 B
YAML
38 lines
650 B
YAML
- name: ensure nginx is installed
|
|
package:
|
|
name: nginx
|
|
state: present
|
|
tags:
|
|
- install
|
|
|
|
- name: ensure nginx is running
|
|
service:
|
|
name: nginx
|
|
state: started
|
|
tags:
|
|
- service
|
|
|
|
- name: ensure nginx is configured for lego
|
|
copy:
|
|
src: lego.nginx.conf
|
|
dest: /etc/nginx/default.d/lego.conf
|
|
owner: root
|
|
group: root
|
|
mode: u=rw,go=r
|
|
notify:
|
|
- reload nginx
|
|
tags:
|
|
- nginx-config
|
|
|
|
- name: ensure firewall allows http acme challenges
|
|
firewalld:
|
|
service: http
|
|
state: enabled
|
|
immediate: true
|
|
when: host_uses_firewalld|d(true)
|
|
tags:
|
|
- firewalld
|
|
|
|
- name: flush handlers
|
|
meta: flush_handlers
|