CCCHH/ansible-infra
CCCHH/ansible-infra
4
2
Fork 1
Code Issues 4 Pull requests 1 Wiki Activity Actions

Deploy certs for zigbee2mqtt.ccchh.net using new certbot role

Browse source 
Also add certbot role to deploy.yaml playbook and add accompanying
group.
This commit is contained in:
June 2023-08-02 22:53:37 +02:00 • committed by julian
commit 154a7dfa02
5 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

5
playbooks/deploy.yaml
View file

@ -57,6 +57,11 @@
roles:
- cert
- name: Ensure certbot and certificate deployment on certbot_hosts
hosts: certbot_hosts
roles:
- certbot
- name: Ensure Docker Compose deployment on docker_compose_hosts
hosts: docker_compose_hosts
roles:

1
playbooks/files/configs/public-reverse-proxy/nginx/acme_challenge.conf
View file

@ -7,6 +7,7 @@ map $host $upstream_acme_challenge_host {
thinkcccore2.ccchh.net 10.31.242.5;
thinkcccore3.ccchh.net 10.31.242.6;
wiki.ccchh.net 10.31.206.13;
zigbee2mqtt.ccchh.net 10.31.208.25:31820;
default "";
}

6
playbooks/files/configs/zigbee2mqtt/nginx/zigbee2mqtt.conf
View file

@ -4,10 +4,10 @@ server {
server_name zigbee2mqtt.ccchh.net;
ssl_certificate /etc/ansible_certs/certs/zigbee2mqtt.ccchh.net/fullchain.pem;
ssl_certificate_key /etc/ansible_certs/certs/zigbee2mqtt.ccchh.net/privkey.pem;
ssl_certificate /etc/letsencrypt/live/zigbee2mqtt.ccchh.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/zigbee2mqtt.ccchh.net/privkey.pem;
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/ansible_certs/certs/zigbee2mqtt.ccchh.net/chain.pem;
ssl_trusted_certificate /etc/letsencrypt/live/zigbee2mqtt.ccchh.net/chain.pem;
add_header Strict-Transport-Security "max-age=63072000" always;