Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
H
homelab
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
GitLab community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
shore
homelab
Commits
f9280622
Commit
f9280622
authored
4 years ago
by
nimrod
Browse files
Options
Downloads
Patches
Plain Diff
Renew certificates playbook.
Renew Let's Encrypt certificates across the fleet.
parent
bc19f017
No related branches found
No related tags found
No related merge requests found
Pipeline
#170
passed
4 years ago
Stage: test
Changes
1
Pipelines
1
Show whitespace changes
Inline
Side-by-side
Showing
1 changed file
renew-certs.yml
+293
-0
293 additions, 0 deletions
renew-certs.yml
with
293 additions
and
0 deletions
renew-certs.yml
0 → 100644
+
293
−
0
View file @
f9280622
---
-
name
:
Generate keys and certificates
hosts
:
-
localhost
connection
:
local
become
:
false
gather_facts
:
false
vars
:
email
:
nimrod@shore.co.il
acme_directory
:
https://acme-v02.api.letsencrypt.org/directory
#acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
acme_version
:
2
handlers
:
-
name
:
Restart Nginx
delegate_to
:
host01.shore.co.il
command
:
docker restart web-proxy_proxy_1
-
name
:
Reload Exim
delegate_to
:
host01.shore.co.il
command
:
docker kill --signal SIGHUP mail_smtp_1
-
name
:
Reload Dovecot
delegate_to
:
host01.shore.co.il
command
:
docker kill --signal SIGHUP mail_imap_1
tasks
:
-
name
:
Create SSL directory on the server
delegate_to
:
host01.shore.co.il
file
:
group
:
root
mode
:
0o0755
owner
:
root
path
:
/var/ssl
state
:
directory
-
name
:
Generate account key
openssl_privatekey
:
mode
:
0o0600
path
:
&account_key_src
account.key
size
:
4096
state
:
present
type
:
RSA
-
name
:
Register account
acme_account
:
account_key_src
:
*account_key_src
acme_directory
:
|-
{{ acme_directory }}
acme_version
:
|-
{{ acme_version }}
contact
:
-
mailto:{{ email }}
select_crypto_backend
:
&crypto_backend
cryptography
state
:
present
terms_agreed
:
true
-
name
:
Generate site key
openssl_privatekey
:
mode
:
&mode
0o0600
path
:
&site_key_src
|-
{{ playbook_dir }}/site.key
size
:
&size
4096
state
:
present
type
:
&type
RSA
-
name
:
Generate site certificate signing request
openssl_csr
:
common_name
:
&common_name
shore.co.il
country_name
:
&country_name
IL
digest
:
&digest
sha256
email_address
:
|-
{{ email }}
locality_name
:
&locality_name
Haifa
organization_name
:
&organization_name
Shore technologies
path
:
&site_csr_src
site.csr
privatekey_path
:
*site_key_src
state
:
present
subject_alt_name
:
|-
DNS:shore.co.il,DNS:www.shore.co.il,DNS:autoconfig.shore.co.il,DNS:nextcloud.shore.co.il,DNS:git.shore.co.il,DNS:registry.shore.co.il
register
:
acme_site_csr
-
name
:
Create site challenge
acme_certificate
:
account_email
:
|-
{{ email }}
account_key_src
:
*account_key_src
acme_directory
:
|-
{{ acme_directory }}
acme_version
:
|
{{ acme_version }}
csr
:
*site_csr_src
fullchain_dest
:
&site_cert_src
|-
{{ playbook_dir }}/site.crt
modify_account
:
false
remaining_days
:
35
select_crypto_backend
:
*crypto_backend
register
:
acme_site_challenge
-
name
:
Debug site challenge
debug
:
var
:
acme_site_challenge
verbosity
:
1
-
name
:
Renew site cert
when
:
acme_site_challenge is changed or acme_site_csr is changed
block
:
-
name
:
Create ACME challenge directory
delegate_to
:
host01.shore.co.il
become
:
true
file
:
path
:
/var/www/www.shore.co.il/.well-known/acme-challenge
state
:
directory
-
name
:
Copy http-01 site challenge
delegate_to
:
host01.shore.co.il
become
:
true
with_dict
:
|
{{ acme_site_challenge['challenge_data'] }}
copy
:
content
:
|-
{{ item.value['http-01']['resource_value'] }}
# yamllint disable-line rule:line-length
dest
:
/var/www/www.shore.co.il/{{ item.value['http-01']['resource'] }}
group
:
www-data
mode
:
0o0644
owner
:
root
-
name
:
Validate site challenge
acme_certificate
:
account_email
:
|-
{{ email }}
account_key_src
:
*account_key_src
acme_directory
:
|-
{{ acme_directory }}
acme_version
:
|
{{ acme_version }}
challenge
:
http-01
csr
:
*site_csr_src
data
:
"
{{
acme_site_challenge
}}"
fullchain_dest
:
*site_cert_src
modify_account
:
false
remaining_days
:
35
select_crypto_backend
:
*crypto_backend
-
name
:
Copy site key, certificate to server
delegate_to
:
host01.shore.co.il
become
:
true
with_items
:
-
src
:
*site_key_src
dest
:
/var/ssl/site.key
mode
:
0o0444
-
src
:
*site_cert_src
dest
:
/var/ssl/site.crt
mode
:
0o0444
copy
:
src
:
|-
{{ item.src }}
dest
:
|-
{{ item.dest }}
mode
:
|-
{{ item.mode }}
owner
:
root
group
:
root
notify
:
-
Restart Nginx
-
name
:
Generate mail key
openssl_privatekey
:
mode
:
*mode
path
:
&mail_key_src
|-
{{ playbook_dir }}/mail.key
size
:
*size
state
:
present
type
:
*type
-
name
:
Generate mail certificate signing request
openssl_csr
:
common_name
:
smtp.shore.co.il
country_name
:
*country_name
digest
:
*digest
email_address
:
|-
{{ email }}
locality_name
:
*locality_name
organization_name
:
*organization_name
path
:
&mail_csr_src
mail.csr
privatekey_path
:
*mail_key_src
state
:
present
subject_alt_name
:
|-
DNS:smtp.shore.co.il,DNS:imap.shore.co.il,DNS:mta-sts.shore.co.il
register
:
acme_mail_csr
-
name
:
Create mail challenge
acme_certificate
:
account_email
:
|-
{{ email }}
account_key_src
:
*account_key_src
acme_directory
:
|-
{{ acme_directory }}
acme_version
:
|
{{ acme_version }}
csr
:
*mail_csr_src
fullchain_dest
:
&mail_cert_src
|-
{{ playbook_dir }}/mail.crt
modify_account
:
false
remaining_days
:
35
select_crypto_backend
:
*crypto_backend
register
:
acme_mail_challenge
-
name
:
Debug mail challenge
debug
:
var
:
acme_mail_challenge
verbosity
:
1
-
name
:
Renew mail cert
when
:
acme_mail_challenge is changed or acme_mail_csr is changed
block
:
-
name
:
Create ACME challenge directory
delegate_to
:
host01.shore.co.il
become
:
true
file
:
path
:
/var/www/mail.shore.co.il/.well-known/acme-challenge
state
:
directory
-
name
:
Copy http-01 mail challenge
delegate_to
:
host01.shore.co.il
become
:
true
with_dict
:
|
{{ acme_mail_challenge['challenge_data'] }}
copy
:
content
:
|-
{{ item.value['http-01']['resource_value'] }}
# yamllint disable-line rule:line-length
dest
:
/var/www/mail.shore.co.il/{{ item.value['http-01']['resource'] }}
group
:
www-data
mode
:
0o0644
owner
:
root
-
name
:
Validate mail challenge
acme_certificate
:
account_email
:
|-
{{ email }}
account_key_src
:
*account_key_src
acme_directory
:
|-
{{ acme_directory }}
acme_version
:
|
{{ acme_version }}
challenge
:
http-01
csr
:
*mail_csr_src
data
:
"
{{
acme_mail_challenge
}}"
fullchain_dest
:
*mail_cert_src
modify_account
:
false
remaining_days
:
35
select_crypto_backend
:
*crypto_backend
-
name
:
Copy mail key, certificate to server
delegate_to
:
host01.shore.co.il
become
:
true
with_items
:
-
src
:
*mail_key_src
dest
:
/var/ssl/mail.key
mode
:
0o0444
-
src
:
*mail_cert_src
dest
:
/var/ssl/mail.crt
mode
:
0o0444
copy
:
src
:
|-
{{ item.src }}
dest
:
|-
{{ item.dest }}
mode
:
|-
{{ item.mode }}
owner
:
root
group
:
root
notify
:
-
Reload Dovecot
-
Reload Exim
-
Restart Nginx
-
name
:
Generate Diffie-Hellman parameters
become
:
true
delegate_to
:
host01.shore.co.il
openssl_dhparam
:
force
:
true
mode
:
0o0644
path
:
/var/ssl/dhparams
size
:
4096
state
:
present
notify
:
-
Reload Dovecot
-
Restart Nginx
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment