mirror of
https://github.com/geerlingguy/ansible-role-certbot.git
synced 2025-04-19 17:01:37 +02:00
64 lines
1.9 KiB
YAML
64 lines
1.9 KiB
YAML
---
|
|
- name: Check if certificate already exists.
|
|
stat:
|
|
path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem
|
|
register: letsencrypt_cert
|
|
|
|
- name: Ensure pre,post,deploy hook folders exist.
|
|
file:
|
|
path: /etc/letsencrypt/renewal-hooks/{{ item }}
|
|
state: directory
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- deploy
|
|
|
|
- name: Create deploy hook to execute tasks post cert generatation.
|
|
template:
|
|
src: renew_hook.j2
|
|
dest: /etc/letsencrypt/renewal-hooks/deploy/renew_hook.sh
|
|
owner: root
|
|
group: root
|
|
mode: 0750
|
|
when:
|
|
- certbot_create_dns_renew_hook_services is defined
|
|
|
|
- name: "Create DNS RFC {{ certbot_dns_plugin }} Credentials File."
|
|
template:
|
|
src: dns_plugin_credentials.j2
|
|
dest: "{{certbot_dns_credentials_file}}"
|
|
owner: root
|
|
group: root
|
|
mode: 0600
|
|
when:
|
|
- certbot_dns_plugin is in certbot_supported_dns_plugins
|
|
|
|
- name: Upload custom dns credential file
|
|
copy:
|
|
src: "{{ certbot_dns_credentials_custom_file }}"
|
|
dest: "{{ certbot_dns_credentials_file }}"
|
|
state: file
|
|
mode: 0600
|
|
owner: root
|
|
group: root
|
|
when:
|
|
- certbot_dns_plugin != 'rfc2136'
|
|
- certbot_dns_credentials_custom_file is defined
|
|
|
|
- name: Generate new certificate if one doesn't exist.
|
|
command: "{{ certbot_dns_create_command }}"
|
|
when: not letsencrypt_cert.stat.exists
|
|
|
|
- name: Assemble certificate crt and key into pem file for haproxy
|
|
assemble:
|
|
dest: "/etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/{{ cert_item.domains | first | replace('*.', '') }}-haproxy.pem"
|
|
src: "/etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/"
|
|
regexp: '(fullchain.pem|privkey.pem)'
|
|
remote_src: yes
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
when:
|
|
- not letsencrypt_cert.stat.exists
|
|
- ('haproxy' is in certbot_create_dns_renew_hook_services)|bool |
