93 lines
3.0 KiB
YAML
93 lines
3.0 KiB
YAML
---
|
|
- name: Obtain Let's Encrypt SSL certificate using ClouDNS
|
|
hosts: certbot
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Set required facts
|
|
ansible.builtin.set_fact:
|
|
cloudns_credentials_path: "/etc/letsencrypt/cloudns.ini"
|
|
|
|
- name: Check if cloudDNS credentials are set or fail
|
|
when: not (cloudns_auth_id is defined and cloudns_auth_password is defined)
|
|
ansible.builtin.fail:
|
|
msg: "CloudDNS credentials are not set"
|
|
|
|
- name: Check if cloudDNS nameserver is set or fail
|
|
when: not (cloudns_nameserver is defined)
|
|
ansible.builtin.fail:
|
|
msg: "CloudDNS nameserver is not set"
|
|
|
|
- name: Remove Certbot installed via package manager (Debian/Ubuntu)
|
|
when: ansible_os_family == "Debian"
|
|
ansible.builtin.apt:
|
|
name:
|
|
- certbot
|
|
state: absent
|
|
|
|
- name: Remove Certbot installed via package manager (RedHat/CentOS)
|
|
when: ansible_os_family == "RedHat"
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- certbot
|
|
state: absent
|
|
|
|
- name: Install cloudDNS plugin dependencies
|
|
ansible.builtin.pip:
|
|
name:
|
|
- certbot
|
|
- certbot-dns-cloudns
|
|
state: present
|
|
|
|
- name: Ensure CloudDNS credentials directory exists
|
|
ansible.builtin.file:
|
|
path: "/etc/letsencrypt"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0700'
|
|
|
|
- name: Create ClouDNS credentials file
|
|
ansible.builtin.copy:
|
|
dest: "{{ cloudns_credentials_path }}"
|
|
content: |
|
|
dns_cloudns_auth_id={{ cloudns_auth_id }}
|
|
dns_cloudns_auth_password={{ cloudns_auth_password }}
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
|
|
- name: Obtain SSL certificate using Certbot with ClouDNS plugin
|
|
ansible.builtin.command: >
|
|
certbot certonly --authenticator dns-cloudns
|
|
--non-interactive
|
|
--agree-tos
|
|
--email {{ certbot_email }}
|
|
--dns-cloudns-credentials {{ cloudns_credentials_path }}
|
|
--dns-cloudns-nameserver {{ cloudns_nameserver }} -d {{ item }}
|
|
args:
|
|
creates: "/etc/letsencrypt/live/{{ item }}/fullchain.pem"
|
|
loop: "{{ certbot_domains }}"
|
|
|
|
- name: Set up automatic certificate renewal
|
|
ansible.builtin.cron:
|
|
name: "Renew Let's Encrypt certificates"
|
|
job: "certbot renew --quiet"
|
|
minute: 0
|
|
hour: 3
|
|
|
|
- name: Setup cockpit certifcate (if defined)
|
|
when: certbot_cockpit_domain is defined
|
|
block:
|
|
- name: Create symlink for Cockpit certificate
|
|
ansible.builtin.file:
|
|
src: "/etc/letsencrypt/live/{{ certbot_cockpit_domain }}/fullchain.pem"
|
|
dest: "/etc/cockpit/ws-certs.d/99-letsencrypt-cert.cert"
|
|
state: link
|
|
|
|
- name: Create symlink for Cockpit private key
|
|
ansible.builtin.file:
|
|
src: "/etc/letsencrypt/live/{{ certbot_cockpit_domain }}/privkey.pem"
|
|
dest: "/etc/cockpit/ws-certs.d/99-letsencrypt-cert.key"
|
|
state: link
|