166 lines
6.2 KiB
YAML
166 lines
6.2 KiB
YAML
---
|
|
- name: Informing user of requirement of two main domains
|
|
when: (certbot.domains | length) < 2 or (certbot.domains | length) > 2
|
|
ansible.builtin.fail:
|
|
msg: Only two domains allowed and required
|
|
- name: Informing user of requirement at least one wildcard
|
|
when: (certbot.domains | select("regex", "^\\*\\.") | list | length) == 0
|
|
ansible.builtin.fail:
|
|
msg: At least one of the FQDNs must have a wildcard
|
|
# - name: Modifying FQDN list for development
|
|
# when: "certbot.mode == 'dev'"
|
|
# ansible.builtin.set_fact:
|
|
# web_fqdns: "{{ certbot.domains | map('regex_replace', '\\.([^\\.]*)$', '.test') | list }}"
|
|
- name: Modifying FQDN list for development
|
|
# when: "certbot.mode == 'prod'"
|
|
ansible.builtin.set_fact:
|
|
web_fqdns: "{{ certbot.domains }}"
|
|
- name: Creating domain arguments for certbot
|
|
ansible.builtin.set_fact:
|
|
certbot_domains: "{{ ['-d'] | product(web_fqdns) | map('join', '=') | list }}"
|
|
- name: Getting public IP
|
|
community.general.ipify_facts:
|
|
validate_certs: false
|
|
timeout: 20
|
|
- name: Starting domain name registration with standalone DNS
|
|
when: "certbot.auth_method == 'dns' and not certbot.containerized"
|
|
ignore_errors: true
|
|
block:
|
|
- name: Opening port 53
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: tcp
|
|
destination_port: 53
|
|
jump: ACCEPT
|
|
comment: Opening up port 53
|
|
# @NOTE https://github.com/siilike/certbot-dns-standalone
|
|
- name: Exemplifying needed ACME record
|
|
ansible.builtin.set_fact:
|
|
acme_record: |
|
|
{{ fqdn | default(inventory_hostname) }} IN A {{ ipify_public_ip }}
|
|
_acme-challenge.{{ fqdn | default(inventory_hostname) }} IN CNAME {{ fqdn | default(inventory_hostname) }}.acme.{{ fqdn | default(inventory_hostname) }}.
|
|
acme.{{ fqdn | default(inventory_hostname) }} IN NS ns.acme.{{ fqdn | default(inventory_hostname) }}.
|
|
ns.acme.{{ fqdn | default(inventory_hostname) }} IN A {{ ipify_public_ip }}
|
|
- name: Informing user of need to set up ACME record
|
|
ansible.builtin.debug:
|
|
msg: "Please set ACME record in domain name provider:\n {{ acme_record }}"
|
|
- name: Waiting for user to set up ACME records
|
|
ansible.builtin.pause:
|
|
- name: Running certbot to authenticate and acquire domain name certificates
|
|
become: true
|
|
when: "certbot.mode == 'dev'"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- certbot
|
|
- certonly
|
|
- "--staging"
|
|
- "--debug"
|
|
- "--authenticator=dns-standalone"
|
|
- "--email={{ certbot.email }}"
|
|
- "--agree-tos"
|
|
- "--non-interactive"
|
|
- "--dns-standalone-address={{ ipify_public_ip }}"
|
|
# - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
|
|
- "--dns-standalone-port={{ certbot.port }}"
|
|
- "{{ certbot_domains[0] }}"
|
|
- "{{ certbot_domains[1] }}"
|
|
- name: Running certbot to authenticate and acquire domain name certificates
|
|
become: true
|
|
when: "certbot.mode == 'prod'"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- certbot
|
|
- certonly
|
|
- "--authenticator=dns-standalone"
|
|
- "--email={{ certbot.email }}"
|
|
- "--agree-tos"
|
|
- "--non-interactive"
|
|
- "--dns-standalone-address={{ ipify_public_ip }}"
|
|
# - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
|
|
- "--dns-standalone-port={{ certbot.port }}"
|
|
- "{{ certbot_domains[0] }}"
|
|
- "{{ certbot_domains[1] }}"
|
|
- name: Starting domain name registration with standalone option
|
|
when: "certbot.auth_method == 'standalone' and not certbot.containerized"
|
|
ignore_errors: true
|
|
block:
|
|
- name: Opening port 80
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: tcp
|
|
destination_port: 80
|
|
jump: ACCEPT
|
|
comment: Open up port 80
|
|
- name: Acquiring domain certificates
|
|
become: true
|
|
when: "certbot.mode == 'dev'"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- certbot
|
|
- certonly
|
|
- "--staging"
|
|
- "--debug"
|
|
- "--standalone"
|
|
- "--preferred-challenges=http-01"
|
|
- "--email={{ certbot.email }}"
|
|
- "--agree-tos"
|
|
- "--non-interactive"
|
|
- "{{ certbot_domains[0] }}"
|
|
- "{{ certbot_domains[1] }}"
|
|
- name: Acquiring domain certificates
|
|
become: true
|
|
when: "certbot.mode == 'dev'"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- certbot
|
|
- certonly
|
|
- "--standalone"
|
|
- "--email {{ certbot.email }}"
|
|
- "--agree-tos"
|
|
- "--non-interactive"
|
|
- "--preferred-challenges http-01"
|
|
- "{{ certbot_domains[0] }}"
|
|
- "{{ certbot_domains[1] }}"
|
|
- name: Creating needed directory for renewal pre- hooks
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: /etc/letsencrypt/renewal-hooks/pre
|
|
recurse: true
|
|
owner: root
|
|
group: root
|
|
mode: "755"
|
|
state: directory
|
|
- name: Copying renewal pre- hook to renewal pre- hook path
|
|
become: true
|
|
ansible.builtin.copy:
|
|
src: letsencrypt/renewal-hooks/pre/down-dependents.sh
|
|
dest: /etc/letsencrypt/renewal-hooks/pre/
|
|
owner: root
|
|
group: root
|
|
mode: "755"
|
|
force: true
|
|
backup: true
|
|
- name: Creating needed directory for renewal post- hooks
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: /etc/letsencrypt/renewal-hooks/post
|
|
recurse: true
|
|
owner: root
|
|
group: root
|
|
mode: "755"
|
|
state: directory
|
|
- name: Copying renewal post- hook to renewal post- hook path
|
|
become: true
|
|
ansible.builtin.copy:
|
|
src: letsencrypt/renewal-hooks/post/up-dependents.sh
|
|
dest: /etc/letsencrypt/renewal-hooks/post/
|
|
owner: root
|
|
group: root
|
|
mode: "755"
|
|
force: true
|
|
backup: true
|
|
- name: Starting domain name registration with webroot option
|
|
when: "certbot.auth_method == 'webroot' and not certbot.containerized"
|
|
block: [] |