Sin descripción
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

letsencrypt.yml 2.7KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. - name: Add group name ssl-cert for SSL certificates
  2. group:
  3. name: ssl-cert
  4. state: present
  5. - name: add stretch-backport for Certbot
  6. apt_repository: repo='deb http://deb.debian.org/debian stretch-backports main' state=present update_cache=yes
  7. tags:
  8. - dependencies
  9. when: ansible_distribution_version == '9'
  10. - name: Install Certbot
  11. apt:
  12. name: "certbot"
  13. state: present
  14. default_release: stretch-backports
  15. tags:
  16. - dependencies
  17. when: ansible_distribution_version == '9'
  18. - name: Install Certbot
  19. apt:
  20. name: "certbot"
  21. state: present
  22. tags:
  23. - dependencies
  24. when: ansible_distribution_version == '10'
  25. - name: Install Certbot
  26. apt:
  27. name: "certbot"
  28. state: present
  29. tags:
  30. - dependencies
  31. when: ansible_distribution_version == '11'
  32. - name: Create directory for LetsEncrypt configuration and certificates
  33. file: state=directory path=/etc/letsencrypt group=root owner=root
  34. - name: Configure LetsEncrypt
  35. template:
  36. src=etc_letsencrypt_cli.conf.j2
  37. dest=/etc/letsencrypt/cli.conf
  38. owner=root
  39. group=root
  40. - name: Create directory for pre-renewal scripts
  41. file: state=directory path=/etc/letsencrypt/prerenew group=root owner=root
  42. - name: Create directory for post-renewal scripts
  43. file: state=directory path=/etc/letsencrypt/postrenew group=root owner=root
  44. - name: Create pre-renew hook to stop apache
  45. copy:
  46. content: "#!/bin/bash\n\nservice apache2 stop\n"
  47. dest: /etc/letsencrypt/prerenew/apache
  48. owner: root
  49. group: root
  50. mode: 0755
  51. - name: Create post-renew hook to start apache
  52. copy:
  53. content: "#!/bin/bash\n\nservice apache2 start\n"
  54. dest: /etc/letsencrypt/postrenew/apache
  55. owner: root
  56. group: root
  57. mode: 0755
  58. - name: Install crontab entry for LetsEncrypt
  59. copy:
  60. src: etc_cron-daily_letsencrypt-renew
  61. dest: /etc/cron.daily/letsencrypt-renew
  62. owner: root
  63. group: root
  64. mode: 0755
  65. - name: Create live directory for LetsEncrypt cron job
  66. file: state=directory path=/etc/letsencrypt/live group=ssl-cert owner=root
  67. - name: Copy script to generate initial certificate
  68. template:
  69. src=root_letsencrypt_gencert.j2
  70. dest=/root/letsencrypt-gencert
  71. owner=root
  72. group=root
  73. mode=0755
  74. - name: Get an SSL certificate for all specified domains and subdomains from Let's Encrypt
  75. command: /root/letsencrypt-gencert creates=/etc/letsencrypt/live/{{ domain }}/privkey.pem
  76. - name: Remove certificate script
  77. file: path=/root/letsencrypt-gencert state=absent
  78. - name: Modify permissions to allow ssl-cert group access to archive
  79. file: path=/etc/letsencrypt/archive owner=root group=ssl-cert mode=0750 recurse=yes
  80. - name: Modify permissions to allow ssl-cert group access to live
  81. file: path=/etc/letsencrypt/live owner=root group=ssl-cert mode=0750 recurse=yes