62 lines
1.9 KiB
YAML
62 lines
1.9 KiB
YAML
|
---
|
||
|
|
- name: Obtain Let's Encrypt SSL certificate using ClouDNS
|
||
|
|
hosts: certbot
|
||
|
|
become: true
|
||
|
|
|
||
|
|
tasks:
|
||
|
|
- name: Set required facts
|
||
|
|
ansible.builtin.set_fact:
|
||
|
|
cloudns_credentials_path: "/etc/letsencrypt/cloudns.ini"
|
||
|
|
|
||
|
|
- name: Check if cloudDNS credentials are set or fail
|
||
|
|
when: not (cloudns_auth_id is defined and cloudns_auth_password is defined)
|
||
|
|
ansible.builtin.fail:
|
||
|
|
msg: "CloudDNS credentials are not set"
|
||
|
|
|
||
|
|
- name: Check if cloudDNS nameserver is set or fail
|
||
|
|
when: not (cloudns_nameserver is defined)
|
||
|
|
ansible.builtin.fail:
|
||
|
|
msg: "CloudDNS nameserver is not set"
|
||
|
|
|
||
|
|
- name: Install Certbot and dependencies
|
||
|
|
when: ansible_os_family == "RedHat"
|
||
|
|
ansible.builtin.dnf:
|
||
|
|
name:
|
||
|
|
- certbot
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Install cloudDNS plugin dependencies
|
||
|
|
ansible.builtin.pip:
|
||
|
|
name:
|
||
|
|
- certbot-dns-cloudns
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Create ClouDNS credentials file
|
||
|
|
ansible.builtin.copy:
|
||
|
|
dest: "{{ cloudns_credentials_path }}"
|
||
|
|
content: |
|
||
|
|
dns_cloudns_auth_id={{ cloudns_auth_id }}
|
||
|
|
dns_cloudns_auth_password={{ cloudns_auth_password }}
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: '0600'
|
||
|
|
|
||
|
|
- name: Obtain SSL certificate using Certbot with ClouDNS plugin
|
||
|
|
ansible.builtin.command: >
|
||
|
|
certbot certonly --authenticator dns-cloudns
|
||
|
|
--non-interactive
|
||
|
|
--agree-tos
|
||
|
|
--email {{ certbot_email }}
|
||
|
|
--dns-cloudns-credentials {{ cloudns_credentials_path }}
|
||
|
|
--dns-cloudns-nameserver {{ cloudns_nameserver }} -d {{ item }}
|
||
|
|
args:
|
||
|
|
creates: "/etc/letsencrypt/live/{{ item }}/fullchain.pem"
|
||
|
|
loop: "{{ certbot_domains }}"
|
||
|
|
|
||
|
|
- name: Set up automatic certificate renewal
|
||
|
|
ansible.builtin.cron:
|
||
|
|
name: "Renew Let's Encrypt certificates"
|
||
|
|
job: "certbot renew --quiet"
|
||
|
|
minute: 0
|
||
|
|
hour: 3
|