From 0ba7078e8c4a73b31501c2c340d59545be886b7d Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Tue, 19 Jan 2021 10:54:42 -0600 Subject: [PATCH 1/9] Issue #134: Snap install method. --- .github/workflows/ci.yml | 2 ++ README.md | 16 +++++++++--- defaults/main.yml | 7 ++--- molecule/default/playbook-snap-install.yml | 26 +++++++++++++++++++ molecule/default/playbook-source-install.yml | 2 +- tasks/install-with-snap.yml | 27 ++++++++++++++++++++ tasks/main.yml | 7 +++-- 7 files changed, 77 insertions(+), 10 deletions(-) create mode 100644 molecule/default/playbook-snap-install.yml create mode 100644 tasks/install-with-snap.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c27f15f..490433f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,6 +52,8 @@ jobs: playbook: converge.yml - distro: centos7 playbook: playbook-source-install.yml + - distro: centos7 + playbook: playbook-snap-install.yml steps: - name: Check out the codebase. diff --git a/README.md b/README.md index f97fbb2..2ebde58 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,8 @@ Generally, installing from source (see section `Source Installation from Git`) l ## Role Variables -The variable `certbot_install_from_source` controls whether to install Certbot from Git or package management. The latter is the default, so the variable defaults to `no`. +TODO. + certbot_auto_renew: true certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}" @@ -60,16 +61,23 @@ Services that should be stopped while `certbot` runs it's own standalone server These services will only be stopped the first time a new cert is generated. +### Snap Installation + +Beginning in December 2020, the Certbot maintainers decided to recommend installing Certbot from Snap rather than maintain scripts like `certbot-auto`. + +Setting `certbot_install_method: snap` configures this role to install Certbot via Snap. + +This install method is currently experimental and may or may not work across all Linux distributions. + ### Source Installation from Git -You can install Certbot from it's Git source repository if desired. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8). +You can install Certbot from it's Git source repository if desired with `certbot_install_method: source`. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8). - certbot_install_from_source: false certbot_repo: https://github.com/certbot/certbot.git certbot_version: master certbot_keep_updated: true -Certbot Git repository options. To install from source, set `certbot_install_from_source` to `yes`. This clones the configured `certbot_repo`, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs. +Certbot Git repository options. If installing from source, the configured `certbot_repo` is cloned, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs. certbot_dir: /opt/certbot diff --git a/defaults/main.yml b/defaults/main.yml index 7002b26..230eccb 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -27,9 +27,10 @@ certbot_create_standalone_stop_services: # - apache # - varnish -# To install from source (on older OSes or if you need a specific or newer -# version of Certbot), set this variable to `yes` and configure other options. -certbot_install_from_source: false +# Available options: 'package', 'snap', 'source'. +certbot_install_method: 'package' + +# Source install configuration. certbot_repo: https://github.com/certbot/certbot.git certbot_version: master certbot_keep_updated: true diff --git a/molecule/default/playbook-snap-install.yml b/molecule/default/playbook-snap-install.yml new file mode 100644 index 0000000..b891248 --- /dev/null +++ b/molecule/default/playbook-snap-install.yml @@ -0,0 +1,26 @@ +--- +- name: Converge + hosts: all + become: true + + vars: + certbot_install_method: 'snap' + certbot_auto_renew_user: root + + pre_tasks: + - name: Update apt cache. + apt: update_cache=yes cache_valid_time=600 + when: ansible_os_family == 'Debian' + changed_when: false + + - name: Install cron (RedHat). + yum: name=cronie state=present + when: ansible_os_family == 'RedHat' + + - name: Install cron (Debian). + apt: name=cron state=present + when: ansible_os_family == 'Debian' + + roles: + - geerlingguy.git + - geerlingguy.certbot diff --git a/molecule/default/playbook-source-install.yml b/molecule/default/playbook-source-install.yml index 77ced51..1e64f7a 100644 --- a/molecule/default/playbook-source-install.yml +++ b/molecule/default/playbook-source-install.yml @@ -4,7 +4,7 @@ become: true vars: - certbot_install_from_source: true + certbot_install_method: 'source' certbot_auto_renew_user: root pre_tasks: diff --git a/tasks/install-with-snap.yml b/tasks/install-with-snap.yml new file mode 100644 index 0000000..dfdcbc2 --- /dev/null +++ b/tasks/install-with-snap.yml @@ -0,0 +1,27 @@ +--- +- name: Ensure snapd is installed. + package: + name: snapd + state: present + +- name: Ensure snapd is enabled. + systemd: + name: snapd.socket + enabled: true + +- name: Enable classic snap support. + file: + source: /var/lib/snapd/snap + dest: /snap + state: link + +- name: Install certbot via snap. + snap: + name: certbot + classic: true + +- name: Symlink certbot into place. + file: + source: /snap/bin/certbot + dest: /usr/bin/certbot + state: link diff --git a/tasks/main.yml b/tasks/main.yml index 52aa6af..acd2426 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -5,10 +5,13 @@ when: ansible_os_family == 'RedHat' - import_tasks: install-with-package.yml - when: not certbot_install_from_source + when: certbot_install_method == 'package' + +- import_tasks: install-with-snap.yml + when: certbot_install_method == 'snap' - import_tasks: install-from-source.yml - when: certbot_install_from_source + when: certbot_install_method == 'source' - include_tasks: create-cert-standalone.yml with_items: "{{ certbot_certs }}" From 56ba6ad8471f83d6808a06549dc7fe5568a090ca Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Tue, 19 Jan 2021 11:02:58 -0600 Subject: [PATCH 2/9] Fix syntax error with file module usage. --- README.md | 3 ++- tasks/install-with-snap.yml | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 2ebde58..7ca52f0 100644 --- a/README.md +++ b/README.md @@ -12,8 +12,9 @@ Generally, installing from source (see section `Source Installation from Git`) l ## Role Variables -TODO. + certbot_install_method: package +Controls how Certbot is installed. Available options are 'package', 'snap', and 'source'. certbot_auto_renew: true certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}" diff --git a/tasks/install-with-snap.yml b/tasks/install-with-snap.yml index dfdcbc2..8b79099 100644 --- a/tasks/install-with-snap.yml +++ b/tasks/install-with-snap.yml @@ -11,7 +11,7 @@ - name: Enable classic snap support. file: - source: /var/lib/snapd/snap + src: /var/lib/snapd/snap dest: /snap state: link @@ -22,6 +22,6 @@ - name: Symlink certbot into place. file: - source: /snap/bin/certbot + src: /snap/bin/certbot dest: /usr/bin/certbot state: link From ea88bfa03caab74afe0635a9a1764d2c4d968f05 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Tue, 19 Jan 2021 11:56:58 -0600 Subject: [PATCH 3/9] Attempt to get snap based install working correctly. --- tasks/install-with-snap.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tasks/install-with-snap.yml b/tasks/install-with-snap.yml index 8b79099..14e18f9 100644 --- a/tasks/install-with-snap.yml +++ b/tasks/install-with-snap.yml @@ -3,6 +3,7 @@ package: name: snapd state: present + register: snapd_install - name: Ensure snapd is enabled. systemd: @@ -15,6 +16,12 @@ dest: /snap state: link +- name: Update snap after install. + shell: sudo snap install core; sudo snap refresh core + changed_when: true + failed_when: false + when: snapd_install is changed + - name: Install certbot via snap. snap: name: certbot From 4f22d025cdffe1b08528070ecfc55bb38ff5e0b1 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Tue, 19 Jan 2021 12:07:46 -0600 Subject: [PATCH 4/9] Slight tweak, but it still won't work. --- tasks/install-with-snap.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/install-with-snap.yml b/tasks/install-with-snap.yml index 14e18f9..2914a58 100644 --- a/tasks/install-with-snap.yml +++ b/tasks/install-with-snap.yml @@ -17,7 +17,7 @@ state: link - name: Update snap after install. - shell: sudo snap install core; sudo snap refresh core + shell: snap install core; snap refresh core changed_when: true failed_when: false when: snapd_install is changed From e34a21f0eb5960901076dbf5a694ed0e39b7add5 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Sun, 21 Feb 2021 09:03:18 -0600 Subject: [PATCH 5/9] Set certbot_script variable for snap-based install. --- tasks/install-with-snap.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tasks/install-with-snap.yml b/tasks/install-with-snap.yml index 2914a58..0651e71 100644 --- a/tasks/install-with-snap.yml +++ b/tasks/install-with-snap.yml @@ -32,3 +32,7 @@ src: /snap/bin/certbot dest: /usr/bin/certbot state: link + +- name: Set Certbot script variable. + set_fact: + certbot_script: /usr/bin/certbot From e10cfdaedb581838fe3bccca2a775a1256d46cf7 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Mon, 22 Feb 2021 16:12:59 -0600 Subject: [PATCH 6/9] Make ansible-lint work again. --- .ansible-lint | 3 ++- .github/workflows/ci.yml | 2 +- .gitignore | 2 ++ 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.ansible-lint b/.ansible-lint index 5557294..acc8255 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -1,2 +1,3 @@ skip_list: - - '106' + - 'yaml' + - 'role-name' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 490433f..b01994b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,7 @@ jobs: python-version: '3.x' - name: Install test dependencies. - run: pip3 install yamllint ansible-lint + run: pip3 install yamllint ansible ansible-lint - name: Lint code. run: | diff --git a/.gitignore b/.gitignore index f56f5b5..8840c8f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ *.retry */__pycache__ *.pyc +.cache + From e93e175a7e8359f4c2174ee61d410cd58f37a89c Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Mon, 15 Mar 2021 09:26:56 -0500 Subject: [PATCH 7/9] Remove ansible-lint from roles. --- .github/workflows/ci.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b01994b..185dae7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,12 +29,11 @@ jobs: python-version: '3.x' - name: Install test dependencies. - run: pip3 install yamllint ansible ansible-lint + run: pip3 install yamllint - name: Lint code. run: | yamllint . - ansible-lint molecule: name: Molecule From 25a661157e295aa8331d1860dbe87515ac454963 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Wed, 31 Mar 2021 11:25:12 -0500 Subject: [PATCH 8/9] Allow failure on snap-based install since containerization makes that hard to test. --- .github/workflows/ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 185dae7..64ed25a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,16 +43,23 @@ jobs: include: - distro: centos8 playbook: converge.yml + experimental: 'false' - distro: centos7 playbook: converge.yml + experimental: 'false' - distro: ubuntu1804 playbook: converge.yml + experimental: 'false' - distro: debian10 playbook: converge.yml + experimental: 'false' - distro: centos7 playbook: playbook-source-install.yml + experimental: 'false' + - distro: centos7 playbook: playbook-snap-install.yml + experimental: 'true' steps: - name: Check out the codebase. @@ -70,6 +77,7 @@ jobs: - name: Run Molecule tests. run: molecule test + continue-on-error: ${{ matrix.experimental }} env: PY_COLORS: '1' ANSIBLE_FORCE_COLOR: '1' From 3c05ff50291dba7b16fc2d7e417a4f768c80eaf9 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Wed, 31 Mar 2021 11:39:22 -0500 Subject: [PATCH 9/9] Use bools I guess. --- .github/workflows/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 64ed25a..11f5d8a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,23 +43,23 @@ jobs: include: - distro: centos8 playbook: converge.yml - experimental: 'false' + experimental: false - distro: centos7 playbook: converge.yml - experimental: 'false' + experimental: false - distro: ubuntu1804 playbook: converge.yml - experimental: 'false' + experimental: false - distro: debian10 playbook: converge.yml - experimental: 'false' + experimental: false - distro: centos7 playbook: playbook-source-install.yml - experimental: 'false' + experimental: false - distro: centos7 playbook: playbook-snap-install.yml - experimental: 'true' + experimental: true steps: - name: Check out the codebase.