Óscar Nájera
0635815b52
Ensure en_US.UTF-8 locale is present
il y a 8 ans
Wolfgang Steitz
3a42d15850
setup posgres within the common role
Postgres is used by several roles, but the setup is currently part of the 'mailserver' role. By moving it to 'common', it's possible to disable the mailserver without breaking the others.
il y a 8 ans
Mike Ashley
fc023dfc31
Clean up merge
Clean up some artifacts from the merge to match the `jessie` branch.
Keep the changes on master made with commits bfe6fe84 and e229c551 .
il y a 8 ans
Tomas Bedrich
3efc7ae54e
Allowed SSH agent forwarding when using sudo
il y a 8 ans
Dosenpfand
9697cbe6b3
Silence letsencrypt cron output unless there is an error
il y a 8 ans
Tomas Bedrich
7a399d45ca
Fix SSH connections to Github
il y a 8 ans
Mike Ashley
0e7adf6e3a
Fix bug exposed by commit 264c232b (#572 )
The `private_key` variable used to check for changes was never
registered.
il y a 8 ans
Simon Schoeters
264c232bbf
Remove duplicate when statement in Let's Encrypt task
While adding the Let's Encrypt offline testing block in 1746afcc we
accidentially duplicated a the 'when' statement. Ansible only looks at
the last when statement for a given block meaning the earlier one has no
use. This commit merges both lines in one.
il y a 8 ans
Allen Riddell
9f34027d8b
Add common default vars to role
il y a 8 ans
Allen Riddell
e95caea06c
common: use password lookup to generate passwords
See https://docs.ansible.com/ansible/playbooks_lookups.html
il y a 8 ans
Dosenpfand
f2c14dd911
Remove unneeded/deprecated apache configuration
il y a 8 ans
Tomas Bedrich
899f527ca3
Updated LE renewal hook system
il y a 8 ans
Tomas Bedrich
9786230808
Changed LE-renew cron frequency
il y a 8 ans
Tomas Bedrich
e08acd2deb
Simplified LE renew script
il y a 8 ans
Carl Meyer
60855eda70
Fix typo in fail2ban config for dovecot.
il y a 8 ans
Mike Ashley
3d68705341
Add leading 0 to octal file permissions
This is done to suppress warnings from ansible-lint.
il y a 8 ans
Mike Ashley
4a33ebecdc
Add non-interactive to LE client options
Depending on when the client is run, there are no certificates to
update. By default, the client runs in interactive mode and wants to
notify the user of this. This causes Ansible to hang waiting for an
acknowledgement that will never come. Adding the non-interactive flag
fixes this.
il y a 8 ans
Carl Meyer
a343509129
No need for letsencrypt.yml to ensure Apache is running.
il y a 8 ans
Carl Meyer
579afa68d3
Add comment into letsencrypt-gencert script clarifying why we stop Apache.
il y a 8 ans
Carl Meyer
0abf92734e
Don't stop Apache until we have to; start it again right after.
il y a 8 ans
Carl Meyer
a636a43948
Don't try to execute any non-executable file in LE postrenew dir.
il y a 8 ans
Carl Meyer
a5f3ec17c1
Workaround bug with enabling SysV scripts on Jessie.
il y a 8 ans
Carl Meyer
c3c2cbf096
Don't bounce Apache unless we actually need to.
il y a 8 ans
Carl Meyer
cc4b3d6fef
Don't request a new LE cert if we have one already.
il y a 8 ans
Carl Meyer
3009c9d2d3
Fix changed-reporting for LE deps installation.
il y a 8 ans
Carl Meyer
e8796ecd28
Idempotent and independent post-certificate-renewal tasks.
il y a 8 ans
nodiscc
d876c87e21
bash syntax cleanup
as per discussion in https://github.com/sovereign/sovereign/pull/504
il y a 8 ans
Carl Meyer
b93deb9411
Remove stray + prefix in sudoers file.
il y a 8 ans
Allen Riddell
a77f9b95ad
Replace deprecated sudo_user with become_user
The ``sudo`` and ``sudo_user`` directives are replaced with ``become``
and ``become_user`` in Ansible 1.9.
il y a 8 ans
Mike Ashley
3d4987c4e2
Use a more descriptive name for cert generation script
il y a 8 ans
Mike Ashley
a38f4e08d3
Force download of letsencrypt release
The installer automatically updates itself, which registers as a change
in the git repo. To maintain idempotency of the task list, the repo
download must be forced.
il y a 8 ans
Mike Ashley
5385badd49
Correct bug in SSL cert setup for test environment
il y a 8 ans
Mike Ashley
bc5bfa4b21
Determine registered subdomains at deploy-time for LE
il y a 9 ans
Mike Ashley
2ad6f78e45
Address incomplete chain error
Fix Apache's configuration for version 2.4.8 and above. See
https://community.letsencrypt.org/t/untrusted-on-mobile-newbe/7903
il y a 9 ans
Mike Ashley
58e9e7a445
Add a short introduction to Let's Encrypt
il y a 9 ans
Mike Ashley
86048ee397
Update prosody to use LE certs directly
Don't copy the LE certificates. Instead use the ssl-cert group to
manage access to the LE certificates directly. See
https://github.com/letsencrypt/letsencrypt/issues/1425 for a request to
have the LE client do this itself.
il y a 9 ans
Mike Ashley
1746afcc3a
Arrange automated tests to not use Let's Encrypt
il y a 9 ans
Mike Ashley
8f1b6a9ed8
Arrange for services to restart on cert renewal
il y a 9 ans
Mike Ashley
65729d12f8
Update xmpp role for LE certificate
il y a 9 ans
Mike Ashley
7bb523950e
Draft design description for Let's Encrypt support
il y a 9 ans
Mike Ashley
8e1d473027
Use Let's Encrypt for generating site certificates
This method uses Subjective Alternative Names (SANs) to get one
certificate for all the subdomains that Sovereign employs, whether or
not the user configured their site with the roles.
il y a 9 ans
Mike Ashley
7f46129a4c
Remove use of wildcard certificate
il y a 9 ans
Mike Ashley
195d8811fc
Remove references to Trusty and Wheezy
Make a clean distinction between Debian 7 and Debian 8. Anticipate the
next Ubuntu LTS release (Xenial) that is planned for support.
il y a 8 ans
Mike Ashley
d3abc02f84
Clean up Apache SSL configuration
Avoid using the Include directive. Move most of the SSL configuration
to the global configuration and leave enabling the SSL engine to each
virtual host that wants to use it.
il y a 9 ans
fengor
e63661f982
Added "UseRoaming no" to ssh.config to fix OpenSSH: client bugs CVE-2016-0777 and CVE-2016-0778
see: http://undeadly.org/cgi?action=article&sid= 2016011414
il y a 9 ans
Sebastian Kriems
fe536873b7
ufw tasks shall have the ufw tag
resolves #453
Conflicts:
roles/common/tasks/ufw.yml
il y a 9 ans
Dan Milon
829c8491c7
restart apache on SSL changes
il y a 9 ans
Dan Milon
a5c6f663ce
properly install changed SSL certificate
il y a 9 ans
Sven Neuhaus
d59c5eff05
Generate 2048 DH group and add it to Postfix
il y a 9 ans
Dan Milon
2fb7cfa7c9
Add SSL stapling cache for apache
Fixes #406
il y a 9 ans