Add role for deploying certbot and setting up certificate using it

This commit is contained in:
June 2023-08-02 20:47:22 +02:00 committed by julian
parent 1b45e94960
commit 5341f9dfba
7 changed files with 104 additions and 0 deletions

View file

@ -0,0 +1,13 @@
# Role `certbot`
A role for deploying Certbot and setting up certificates using it.
Note: This role doesn't take care of deleting certificates.
## Required Arguments
For the required arguments look at the [`argument_specs.yaml`](./meta/argument_specs.yaml).
## `hosts`
The `hosts` for this role need to be the machines on which you want to make sure Certbot is deployed and given certificates are set up.

View file

@ -0,0 +1,21 @@
argument_specs:
main:
options:
certbot__version_spec:
description: >-
The version specification to use for installing the `certbot` package.
The provided version specification will be used like the following:
`cerbot={{ certbot__version_spec }}*`. This makes it possible to e.g.
specify until a minor version (like `1.3.`) and then have patch
versions be installed automatically (like `1.3.1` and so on).
type: str
required: true
certbot__acme_account_email_address:
description: The E-Mail address to give to certbot for the ACME account.
type: str
required: true
certbot__certificate_domains:
description: The domains for which to obtain a certificate.
type: list
elements: str
required: true

View file

@ -0,0 +1,9 @@
---
dependencies:
- role: distribution_check
vars:
distribution_check__distribution_support_spec:
- name: Debian
major_versions:
- 11
- 12

View file

@ -0,0 +1,7 @@
- name: ensure certbot installation
ansible.builtin.import_tasks:
file: main/install.yaml
- name: ensure certificates
ansible.builtin.import_tasks:
file: main/certs.yaml

View file

@ -0,0 +1,22 @@
- name: get expiry date before
ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
ignore_errors: true
become: true
changed_when: false
register: certbot__cert_expiry_before
- name: obtain the certificate using certbot
ansible.builtin.command: /usr/bin/certbot certonly --keep-until-expiring --agree-tos --non-interactive --email "{{ certbot__acme_account_email_address }}" --no-eff-email --webroot --webroot-path /webroot-for-acme-challenge -d "{{ item }}"
become: true
changed_when: false
- name: get expiry date after
ansible.builtin.command: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/{{ item }}/fullchain.pem
become: true
changed_when: false
register: certbot__cert_expiry_after
- name: potentially report changed
ansible.builtin.debug:
msg: "If this reports changed, then the certificate expiry date and therefore the certificate changed."
changed_when: certbot__cert_expiry_before.stdout != certbot__cert_expiry_after.stdout

View file

@ -0,0 +1,13 @@
- name: ensure directory for the webroot exists
ansible.builtin.file:
path: /webroot-for-acme-challenge/
state: directory
mode: "0755"
owner: root
group: root
become: true
- name: obtain certificates
loop: "{{ certbot__certificate_domains }}"
ansible.builtin.include_tasks:
file: main/cert.yaml

View file

@ -0,0 +1,19 @@
- name: make sure the `openssl` package is installed
ansible.builtin.apt:
name: openssl
state: present
become: true
- name: make sure the `certbot` package is installed
ansible.builtin.apt:
name: certbot={{ certbot__version_spec }}*
state: present
allow_change_held_packages: true
update_cache: true
become: true
- name: apt-mark hold `certbot`
ansible.builtin.dpkg_selections:
name: certbot
selection: hold
become: true