~xenrox/ansible

ref: deebbfb94ad05998dd75a2006b8baf6ffff75f1e ansible/roles/certbot/tasks/main.yml -rw-r--r-- 1.7 KiB
deebbfb9Thorben Günther CI: Disable molecule 2 months ago
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
---
- name: Get hetzner secrets
  ansible.builtin.set_fact:
    hetzner_secrets: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/hetzner') }}"

- name: Install
  community.general.pacman:
    name: certbot-dns-hetzner
    state: present

- name: Create secrets path
  ansible.builtin.file:
    path: /etc/.secrets
    state: directory
    owner: root
    group: root
    mode: 0700

- name: Install Hetzner API key
  ansible.builtin.template:
    src: hetzner.ini.j2
    dest: /etc/.secrets/hetzner.ini
    owner: root
    group: root
    mode: 0600

- name: Request certificate
  ansible.builtin.command:
    # Support minio dns style buckets
    cmd: certbot certonly --agree-tos --authenticator dns-hetzner --dns-hetzner-credentials /etc/.secrets/hetzner.ini -d xenrox.net,*.xenrox.net,*.minio.xenrox.net --rsa-key-size 4096 --email admin@xenrox.net
    creates: /etc/letsencrypt/live/xenrox.net/privkey.pem

- name: Install renewal service
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: /etc/systemd/system/{{ item }}
    owner: root
    group: root
    mode: 0644
  with_items:
    - certbot-renewal.service
    - certbot-renewal.timer

- name: Enable renewal service
  ansible.builtin.systemd:
    name: certbot-renewal.timer
    enabled: true
    state: started
    daemon_reload: true

- name: Install hook
  ansible.builtin.copy:
    src: hook.sh
    dest: /etc/letsencrypt/hook.sh
    owner: root
    group: root
    mode: 0755

- name: Create hook dir
  ansible.builtin.file:
    path: /etc/letsencrypt/hook.d
    state: directory
    owner: root
    group: root
    mode: 0755

- name: Install gotify hook
  ansible.builtin.copy:
    src: gotify.hook
    dest: /etc/letsencrypt/hook.d/gotify
    owner: root
    group: root
    mode: 0755