61 lines
1.7 KiB
YAML
61 lines
1.7 KiB
YAML
|
---
|
||
|
|
- name: Remove certbot installed via package manager
|
||
|
|
become: true
|
||
|
|
ansible.builtin.dnf:
|
||
|
|
name: certbot
|
||
|
|
state: absent
|
||
|
|
|
||
|
|
- name: Install pip
|
||
|
|
become: true
|
||
|
|
ansible.builtin.dnf:
|
||
|
|
name: python3-pip
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Install certbot and DNS plugin via pip
|
||
|
|
become: true
|
||
|
|
ansible.builtin.pip:
|
||
|
|
name:
|
||
|
|
- certbot
|
||
|
|
- certbot-dns-cloudns
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Ensure CloudDNS credentials directory exists
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/letsencrypt
|
||
|
|
state: directory
|
||
|
|
mode: '0700'
|
||
|
|
|
||
|
|
- name: Create CloudDNS credentials file
|
||
|
|
become: true
|
||
|
|
ansible.builtin.copy:
|
||
|
|
content: |
|
||
|
|
dns_cloudns_auth_id={{ nginx_proxy_cloudns_auth_id }}
|
||
|
|
dns_cloudns_auth_password={{ nginx_proxy_cloudns_auth_password }}
|
||
|
|
dest: "{{ nginx_proxy_certbot_credential_file }}"
|
||
|
|
mode: "{{ nginx_proxy_certbot_credential_mode }}"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
|
||
|
|
- name: Obtain TLS certificate via DNS-01 challenge
|
||
|
|
become: true
|
||
|
|
ansible.builtin.command: >-
|
||
|
|
certbot certonly
|
||
|
|
--authenticator dns-cloudns
|
||
|
|
--dns-cloudns-credentials {{ nginx_proxy_certbot_credential_file }}
|
||
|
|
--dns-cloudns-nameserver {{ nginx_proxy_cloudns_nameserver }}
|
||
|
|
-d {{ __nginx_proxy_certbot_domains | join(' -d ') }}
|
||
|
|
--non-interactive
|
||
|
|
--agree-tos
|
||
|
|
-m {{ nginx_proxy_certbot_email }}
|
||
|
|
args:
|
||
|
|
creates: "/etc/letsencrypt/live/{{ __nginx_proxy_certbot_domains[0] }}/fullchain.pem"
|
||
|
|
|
||
|
|
- name: Create certbot renewal cron job
|
||
|
|
become: true
|
||
|
|
ansible.builtin.cron:
|
||
|
|
name: "certbot renewal"
|
||
|
|
minute: "{{ nginx_proxy_certbot_cron_minute }}"
|
||
|
|
hour: "{{ nginx_proxy_certbot_cron_hour }}"
|
||
|
|
job: "certbot renew --deploy-hook 'systemctl reload nginx'"
|