99 lines
2.8 KiB
YAML
99 lines
2.8 KiB
YAML
---
|
|
- name: Get latest lego version
|
|
become: false
|
|
delegate_to: localhost
|
|
run_once: true
|
|
when: lego_version is undefined
|
|
block:
|
|
- name: Get latest version from Github
|
|
github_release: # needs Python Module github3.py
|
|
user: go-acme
|
|
repo: lego
|
|
action: latest_release
|
|
token: "{{ vault_github_token }}"
|
|
register: lego_github_version
|
|
|
|
- name: "{{ lego_github_version }}"
|
|
set_fact:
|
|
lego_version: "{{ lego_github_version.tag }}"
|
|
|
|
- name: Set architecture alias
|
|
set_fact:
|
|
architecture_alias: "amd64" # noqa: var-naming[no-role-prefix]
|
|
when: ansible_architecture == "x86_64"
|
|
|
|
- name: Set architecture alias
|
|
set_fact:
|
|
architecture_alias: "arm64" # noqa: var-naming[no-role-prefix]
|
|
when: ansible_architecture == "aarch64"
|
|
|
|
- name: "Download lego from GitHub"
|
|
get_url:
|
|
url: "https://github.com/go-acme/lego/releases/download/\
|
|
{{ lego_version }}/lego_{{ lego_version }}\
|
|
_linux_{{ architecture_alias }}.tar.gz"
|
|
dest: "/var/tmp/lego.tar.gz"
|
|
mode: "0644"
|
|
register: lego_download_archive
|
|
until: lego_download_archive is succeeded
|
|
retries: 3
|
|
delay: 5
|
|
|
|
- name: Unpack lego
|
|
unarchive:
|
|
remote_src: true
|
|
src: "/var/tmp/lego.tar.gz"
|
|
dest: "{{ lego_install_dir }}"
|
|
extra_opts:
|
|
- --one-top-level
|
|
include:
|
|
- lego
|
|
|
|
- name: Create lego config directory
|
|
file:
|
|
path: "{{ lego_config_dir }}"
|
|
mode: "0755"
|
|
state: directory
|
|
|
|
- name: Copy ACME renew-hook script
|
|
template:
|
|
src: "renew-hook.sh.j2"
|
|
dest: "{{ lego_config_dir }}/renew-hook.sh"
|
|
mode: "0750"
|
|
vars:
|
|
lego_cert_dir: "{{ lego_config_dir }}/certificates"
|
|
|
|
- name: Register lego and create cert
|
|
shell: >
|
|
{{ lego_install_dir }}/lego --accept-tos
|
|
--domains="{{ item.cn }}"
|
|
{% if item.sans is defined and item.sans %}
|
|
{% for san in item.sans %}--domains="{{ san }}" {% endfor %}
|
|
{% endif %}
|
|
{{ lego_cli_params | join(' ') }}
|
|
run &&
|
|
{{ lego_config_dir }}/renew-hook.sh '{{ item.cn }}'
|
|
args:
|
|
creates: "{{ lego_certificate_destination.path | default(lego_config_dir + '/certificates') }}/{{ item.cn }}.crt"
|
|
environment: '{ "{{ lego_provider|upper }}_API_KEY": "{{ vault_ionos_token_dns }}" }'
|
|
loop: "{{ lego_certificate_domains }}"
|
|
loop_control:
|
|
label: "{{ item.cn }}"
|
|
|
|
- name: Copy lego systemd service
|
|
template:
|
|
src: "lego.{{ item.1 }}.j2"
|
|
dest: "/etc/systemd/system/lego_{{ item.0.cn }}.{{ item.1 }}"
|
|
mode: "0644"
|
|
loop: "{{ lego_certificate_domains | product(['service', 'timer']) | list }}"
|
|
loop_control:
|
|
label: "lego_{{ item.0.cn }}.{{ item.1 }}"
|
|
|
|
- name: Start lego_timer
|
|
systemd:
|
|
daemon_reload: true
|
|
enabled: true
|
|
name: "lego_{{ item.cn }}.timer"
|
|
state: started
|
|
loop: "{{ lego_certificate_domains }}"
|