diff --git a/README.md b/README.md index 101c6f3..ba8cf6a 100644 --- a/README.md +++ b/README.md @@ -2,30 +2,31 @@ [![Build Status](https://travis-ci.org/geerlingguy/ansible-role-certbot.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-certbot) -Installs Certbot (for Let's Encrypt) for RHEL/CentOS or Debian/Ubuntu. +Installs and configures Certbot (for Let's Encrypt). ## Requirements -Certbot requires Git to be installed. You can install Git using the `geerlingguy.git` role. +Certbot requires Git to be installed if one wants to install Certbot from Git repository instead of package management. You can install Git using the `geerlingguy.git` role. ## Role Variables + certbot_from_git: no certbot_repo: https://github.com/certbot/certbot.git certbot_version: master certbot_keep_updated: yes -Certbot code repository options. This role clones the agent from the configured repo, then makes the `certbot-auto` script executable. +Certbot Git repository options. This role clones the agent from the configured repo, then makes the `certbot-auto` script executable if `certbot_from_git` is `yes`. Otherwise it will be installed from distribution's package management. certbot_dir: /opt/certbot -The directory inside which Certbot will be cloned. +The directory inside which Certbot will be cloned when using Git. certbot_auto_renew: true certbot_auto_renew_user: "{{ ansible_user }}" certbot_auto_renew_hour: 3 certbot_auto_renew_minute: 30 -By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot-auto renew` via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account. +By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account. ## Dependencies @@ -34,20 +35,20 @@ None. ## Example Playbook - hosts: servers - + vars: certbot_auto_renew_user: your_username_here certbot_auto_renew_minute: 20 certbot_auto_renew_hour: 5 - + roles: - geerlingguy.certbot -After installation, you can create certificates using the `certbot-auto` script, which by default is installed inside the configured `certbot_dir`, so by default, `/opt/certbot/certbot-auto`. Here are some example commands to configure certificates with Certbot: +After installation, you can create certificates using the `certbot` (or `certbot-auto`) script, which by default is installed inside the configured `certbot_dir` (when using Git). Here are some example commands to configure certificates with Certbot: # Automatically add certs for all Apache virtualhosts (use with caution!). /opt/certbot/certbot-auto --apache - + # Generate certs, but don't modify Apache configuration (safer). /opt/certbot/certbot-auto --apache certonly diff --git a/defaults/main.yml b/defaults/main.yml index 793362c..53be380 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,10 +1,11 @@ --- # Where to get Certbot. +certbot_from_git: no certbot_repo: https://github.com/certbot/certbot.git certbot_version: master certbot_keep_updated: yes -# Where to put Certbot. +# Where to put Certbot when cloning from Git. certbot_dir: /opt/certbot # How to keep Certbot certs up to date. diff --git a/meta/main.yml b/meta/main.yml index 2a9422b..ee4dc79 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -3,7 +3,7 @@ dependencies: [] galaxy_info: author: geerlingguy - description: "Certbot (for Let's Encrypt) for RHEL/CentOS and Debian/Ubuntu." + description: "Installs and configures Certbot (for Let's Encrypt)." company: "Midwestern Mac, LLC" license: "license (BSD, MIT)" min_ansible_version: 1.8 @@ -12,12 +12,15 @@ galaxy_info: versions: - 6 - 7 + - name: Fedora + versions: + - all - name: Ubuntu versions: - - all + - all - name: Debian versions: - - all + - all galaxy_tags: - networking - system diff --git a/tasks/install-from-git.yml b/tasks/install-from-git.yml new file mode 100644 index 0000000..8ff2040 --- /dev/null +++ b/tasks/install-from-git.yml @@ -0,0 +1,17 @@ +--- +- name: Clone Certbot into configured directory. + git: + repo: "{{ certbot_repo }}" + dest: "{{ certbot_dir }}" + version: "{{ certbot_version }}" + update: "{{ certbot_keep_updated }}" + force: yes + +- name: Set Certbot script variable + set_fact: + certbot_script: "{{ certbot_dir }}/certbot-auto" + +- name: Ensure certbot-auto is executable. + file: + path: "{{ certbot_script }}" + mode: 0755 diff --git a/tasks/install-from-package.yml b/tasks/install-from-package.yml new file mode 100644 index 0000000..20f4a2f --- /dev/null +++ b/tasks/install-from-package.yml @@ -0,0 +1,7 @@ +--- +- name: Install Certbot + package: name=certbot state=present + +- name: Set Certbot script variable + set_fact: + certbot_script: certbot diff --git a/tasks/main.yml b/tasks/main.yml index 5e17fb6..d68f47b 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,22 +1,9 @@ --- -- name: Clone Certbot into configured directory. - git: - repo: "{{ certbot_repo }}" - dest: "{{ certbot_dir }}" - version: "{{ certbot_version }}" - update: "{{ certbot_keep_updated }}" - force: yes +- include: install-from-package.yml + when: not certbot_from_git and (ansible_distribution == 'Fedora' or ansible_distribution == 'RedHat') -- name: Ensure certbot-auto is executable. - file: - path: "{{ certbot_dir }}/certbot-auto" - mode: 0755 +- include: install-from-git.yml + when: certbot_from_git or (ansible_distribution != 'Fedora' and ansible_distribution != 'RedHat') -- name: Add cron job for 'certbot-auto renew' (if configured). - cron: - name: Certbot automatic renewal. - job: "{{ certbot_dir }}/certbot-auto renew --quiet --no-self-upgrade" - minute: "{{ certbot_auto_renew_minute }}" - hour: "{{ certbot_auto_renew_hour }}" - user: "{{ certbot_auto_renew_user }}" +- include: renew-cron.yml when: certbot_auto_renew diff --git a/tasks/renew-cron.yml b/tasks/renew-cron.yml new file mode 100644 index 0000000..7678a7c --- /dev/null +++ b/tasks/renew-cron.yml @@ -0,0 +1,8 @@ +--- +- name: Add cron job for certbot renewal (if configured). + cron: + name: Certbot automatic renewal. + job: "{{ certbot_script }} renew --quiet --no-self-upgrade" + minute: "{{ certbot_auto_renew_minute }}" + hour: "{{ certbot_auto_renew_hour }}" + user: "{{ certbot_auto_renew_user }}"