alexandre.pires
272ed647cf
- Updated host_vars for dev-02 to include login history settings and modified code server authentication. - Adjusted opencode server configurations and reduced resource allocation. - Introduced a new playbook for configuring nginx reverse proxy with TLS and OAuth2. - Enhanced linux_dev_station role defaults and tasks, including package updates and service configurations. - Removed unnecessary credential assertions in linux_dev_station tasks. - Created nginx_proxy role with tasks for certbot, nginx installation, and oauth2-proxy setup. - Added templates for nginx and oauth2-proxy configurations. - Updated terraform configuration to reflect new DNS records for ide and agent services. - Documented changes and configurations in linux_dev_station.md for clarity and future reference.
61 lines
1.7 KiB
YAML
61 lines
1.7 KiB
YAML
---
|
|
- name: Remove certbot installed via package manager
|
|
become: true
|
|
ansible.builtin.dnf:
|
|
name: certbot
|
|
state: absent
|
|
|
|
- name: Install pip
|
|
become: true
|
|
ansible.builtin.dnf:
|
|
name: python3-pip
|
|
state: present
|
|
|
|
- name: Install certbot and DNS plugin via pip
|
|
become: true
|
|
ansible.builtin.pip:
|
|
name:
|
|
- certbot
|
|
- certbot-dns-cloudns
|
|
state: present
|
|
|
|
- name: Ensure CloudDNS credentials directory exists
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: /etc/letsencrypt
|
|
state: directory
|
|
mode: '0700'
|
|
|
|
- name: Create CloudDNS credentials file
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: |
|
|
dns_cloudns_auth_id={{ nginx_proxy_cloudns_auth_id }}
|
|
dns_cloudns_auth_password={{ nginx_proxy_cloudns_auth_password }}
|
|
dest: "{{ nginx_proxy_certbot_credential_file }}"
|
|
mode: "{{ nginx_proxy_certbot_credential_mode }}"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Obtain TLS certificate via DNS-01 challenge
|
|
become: true
|
|
ansible.builtin.command: >-
|
|
certbot certonly
|
|
--authenticator dns-cloudns
|
|
--dns-cloudns-credentials {{ nginx_proxy_certbot_credential_file }}
|
|
--dns-cloudns-nameserver {{ nginx_proxy_cloudns_nameserver }}
|
|
-d {{ __nginx_proxy_certbot_domains | join(' -d ') }}
|
|
--non-interactive
|
|
--agree-tos
|
|
-m {{ nginx_proxy_certbot_email }}
|
|
args:
|
|
creates: "/etc/letsencrypt/live/{{ __nginx_proxy_certbot_domains[0] }}/fullchain.pem"
|
|
|
|
- name: Create certbot renewal cron job
|
|
become: true
|
|
ansible.builtin.cron:
|
|
name: "certbot renewal"
|
|
minute: "{{ nginx_proxy_certbot_cron_minute }}"
|
|
hour: "{{ nginx_proxy_certbot_cron_hour }}"
|
|
job: "certbot renew --deploy-hook 'systemctl reload nginx'"
|