Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
92 lines
3.2 KiB
YAML
92 lines
3.2 KiB
YAML
---
|
|
# Provision a Let's Encrypt certificate for a hostname using the webroot method.
|
|
#
|
|
# Required variables:
|
|
# - certbot_hostname: the domain to provision (e.g. "apk.jokester.fr")
|
|
# - acme_email: Let's Encrypt account email (typically from host_vars)
|
|
#
|
|
# Let's Encrypt only issues for publicly-resolvable hostnames, so gate the
|
|
# include on the service's `<service>_nginx_letsencrypt` flag (default false;
|
|
# internal names fall back to the shared self-signed cert).
|
|
#
|
|
# Usage from a service role:
|
|
# - name: Provision TLS certificate
|
|
# ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
|
|
# vars:
|
|
# certbot_hostname: "{{ myservice_nginx_hostname }}"
|
|
# when: myservice_nginx_enabled and myservice_nginx_letsencrypt
|
|
|
|
- name: Validate certbot requirements
|
|
ansible.builtin.assert:
|
|
that:
|
|
- certbot_hostname is defined
|
|
- certbot_hostname | length > 0
|
|
- acme_email is defined
|
|
- acme_email | length > 0
|
|
fail_msg: |
|
|
certbot_hostname and acme_email are required for certificate provisioning.
|
|
Set acme_email in host_vars and pass certbot_hostname when including this task file.
|
|
success_msg: "Certbot requirements validated for {{ certbot_hostname }}"
|
|
|
|
- name: Check if certificate already exists for {{ certbot_hostname }}
|
|
ansible.builtin.stat:
|
|
path: "/etc/letsencrypt/live/{{ certbot_hostname }}/fullchain.pem"
|
|
register: certbot_cert_file
|
|
|
|
- name: Ensure letsencrypt directories are traversable by nginx
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- /etc/letsencrypt/live
|
|
- /etc/letsencrypt/archive
|
|
when: certbot_cert_file.stat.exists
|
|
|
|
- name: Provision certificate for {{ certbot_hostname }}
|
|
when: not certbot_cert_file.stat.exists
|
|
block:
|
|
- name: Deploy temporary HTTP-only vhost for ACME challenge
|
|
ansible.builtin.template:
|
|
src: "{{ role_path }}/../nginx/templates/vhost-http-acme.conf.j2"
|
|
dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/{{ certbot_hostname | replace('.', '_') }}_acme_temp.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Reload nginx to activate temporary ACME vhost
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: reloaded
|
|
|
|
- name: Request certificate from Let's Encrypt for {{ certbot_hostname }}
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
certbot certonly
|
|
--webroot
|
|
-w /var/www/certbot
|
|
-d {{ certbot_hostname }}
|
|
--email {{ acme_email }}
|
|
--agree-tos
|
|
--non-interactive
|
|
creates: "/etc/letsencrypt/live/{{ certbot_hostname }}/fullchain.pem"
|
|
|
|
- name: Fix letsencrypt directory permissions for nginx
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
mode: "0755"
|
|
loop:
|
|
- /etc/letsencrypt/live
|
|
- /etc/letsencrypt/archive
|
|
|
|
always:
|
|
- name: Remove temporary ACME vhost
|
|
ansible.builtin.file:
|
|
path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/{{ certbot_hostname | replace('.', '_') }}_acme_temp.conf"
|
|
state: absent
|
|
|
|
- name: Reload nginx after certificate provisioning
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: reloaded
|