diff options
| author | Emil Renner Berthing <esmil@labitat.dk> | 2021-01-19 19:20:48 +0100 |
|---|---|---|
| committer | Emil Renner Berthing <esmil@labitat.dk> | 2021-01-19 22:39:39 +0100 |
| commit | 3da205a190c0b6f36a726d90afa4dc303ee84ffe (patch) | |
| tree | a77a5d2f52916b3b935941d81565faf9760a536d /roles/space_server/tasks | |
| parent | 1e59205900d8037d13290832625041f3edde0cac (diff) | |
| download | labitat-ansible-3da205a190c0b6f36a726d90afa4dc303ee84ffe.tar.gz labitat-ansible-3da205a190c0b6f36a726d90afa4dc303ee84ffe.tar.xz labitat-ansible-3da205a190c0b6f36a726d90afa4dc303ee84ffe.zip | |
space_server: certbot: get space.labitat.dk certificate
Diffstat (limited to 'roles/space_server/tasks')
| -rw-r--r-- | roles/space_server/tasks/certbot.yml | 43 | ||||
| -rw-r--r-- | roles/space_server/tasks/main.yml | 17 |
2 files changed, 60 insertions, 0 deletions
diff --git a/roles/space_server/tasks/certbot.yml b/roles/space_server/tasks/certbot.yml new file mode 100644 index 0000000..5e222ae --- /dev/null +++ b/roles/space_server/tasks/certbot.yml @@ -0,0 +1,43 @@ +--- +- name: Create space.labitat.dk certificate + command: + argv: + - '/usr/bin/certbot' + - 'certonly' + - '--non-interactive' + - '--agree-tos' + - '--no-eff-email' + - '--max-log-backups' + - '99' + - '--standalone' + - '--preferred-challenges' + - 'http' + - '--key-type' + - 'rsa' + - '-m' + - 'noc@labitat.dk' + - '-d' + - 'space.labitat.dk' + creates: '/etc/letsencrypt/renewal/space.labitat.dk.conf' + +- name: Configure certbot renewal + lineinfile: + path: '/etc/sysconfig/certbot' + regexp: '{{ item.regexp }}' + line: '{{ item.line }}' + with_items: + - regexp: '^CERTBOT_ARGS=' + line: 'CERTBOT_ARGS="--max-log-backups 99"' + +- name: Enable certbot renewal timer + systemd: + name: certbot-renew.timer + enabled: yes + masked: no + state: started + when: not chroot +- name: '- when in chroot' + command: systemctl enable certbot-renew.timer + when: chroot + +# vim: set ts=2 sw=2 et ft=yaml: diff --git a/roles/space_server/tasks/main.yml b/roles/space_server/tasks/main.yml index 3768d5e..b19e8a3 100644 --- a/roles/space_server/tasks/main.yml +++ b/roles/space_server/tasks/main.yml @@ -9,6 +9,21 @@ tags: - fstab +- name: Disable selinux-autorelabel-mark service + systemd: + name: selinux-autorelabel-mark.service + enabled: no + masked: no + state: stopped + when: not chroot + tags: + - selinux +- name: '- when in chroot' + command: systemctl disable selinux-autorelabel-mark.service + when: chroot + tags: + - selinux + - name: Extra ssh hosts copy: dest: '/etc/ssh/ssh_config.d/60-switches.conf' @@ -27,6 +42,8 @@ tags: networkd - import_tasks: nftables.yml tags: nftables +- import_tasks: certbot.yml + tags: certbot - import_tasks: chrony.yml tags: chrony - import_tasks: bird.yml |