aboutsummaryrefslogtreecommitdiffstats
path: root/roles/space_server/tasks
diff options
context:
space:
mode:
authorEmil Renner Berthing <esmil@labitat.dk>2021-01-19 19:20:48 +0100
committerEmil Renner Berthing <esmil@labitat.dk>2021-01-19 22:39:39 +0100
commit3da205a190c0b6f36a726d90afa4dc303ee84ffe (patch)
treea77a5d2f52916b3b935941d81565faf9760a536d /roles/space_server/tasks
parent1e59205900d8037d13290832625041f3edde0cac (diff)
downloadlabitat-ansible-3da205a190c0b6f36a726d90afa4dc303ee84ffe.tar.gz
labitat-ansible-3da205a190c0b6f36a726d90afa4dc303ee84ffe.tar.xz
labitat-ansible-3da205a190c0b6f36a726d90afa4dc303ee84ffe.zip
space_server: certbot: get space.labitat.dk certificate
Diffstat (limited to 'roles/space_server/tasks')
-rw-r--r--roles/space_server/tasks/certbot.yml43
-rw-r--r--roles/space_server/tasks/main.yml17
2 files changed, 60 insertions, 0 deletions
diff --git a/roles/space_server/tasks/certbot.yml b/roles/space_server/tasks/certbot.yml
new file mode 100644
index 0000000..5e222ae
--- /dev/null
+++ b/roles/space_server/tasks/certbot.yml
@@ -0,0 +1,43 @@
+---
+- name: Create space.labitat.dk certificate
+ command:
+ argv:
+ - '/usr/bin/certbot'
+ - 'certonly'
+ - '--non-interactive'
+ - '--agree-tos'
+ - '--no-eff-email'
+ - '--max-log-backups'
+ - '99'
+ - '--standalone'
+ - '--preferred-challenges'
+ - 'http'
+ - '--key-type'
+ - 'rsa'
+ - '-m'
+ - 'noc@labitat.dk'
+ - '-d'
+ - 'space.labitat.dk'
+ creates: '/etc/letsencrypt/renewal/space.labitat.dk.conf'
+
+- name: Configure certbot renewal
+ lineinfile:
+ path: '/etc/sysconfig/certbot'
+ regexp: '{{ item.regexp }}'
+ line: '{{ item.line }}'
+ with_items:
+ - regexp: '^CERTBOT_ARGS='
+ line: 'CERTBOT_ARGS="--max-log-backups 99"'
+
+- name: Enable certbot renewal timer
+ systemd:
+ name: certbot-renew.timer
+ enabled: yes
+ masked: no
+ state: started
+ when: not chroot
+- name: '- when in chroot'
+ command: systemctl enable certbot-renew.timer
+ when: chroot
+
+# vim: set ts=2 sw=2 et ft=yaml:
diff --git a/roles/space_server/tasks/main.yml b/roles/space_server/tasks/main.yml
index 3768d5e..b19e8a3 100644
--- a/roles/space_server/tasks/main.yml
+++ b/roles/space_server/tasks/main.yml
@@ -9,6 +9,21 @@
tags:
- fstab
+- name: Disable selinux-autorelabel-mark service
+ systemd:
+ name: selinux-autorelabel-mark.service
+ enabled: no
+ masked: no
+ state: stopped
+ when: not chroot
+ tags:
+ - selinux
+- name: '- when in chroot'
+ command: systemctl disable selinux-autorelabel-mark.service
+ when: chroot
+ tags:
+ - selinux
+
- name: Extra ssh hosts
copy:
dest: '/etc/ssh/ssh_config.d/60-switches.conf'
@@ -27,6 +42,8 @@
tags: networkd
- import_tasks: nftables.yml
tags: nftables
+- import_tasks: certbot.yml
+ tags: certbot
- import_tasks: chrony.yml
tags: chrony
- import_tasks: bird.yml