mailserver: add broken sogo

ansible/mailserver/roles/certbot/tasks/main.yml

@@ -0,0 +1,87 @@
+---
+- name: Install certbot
+  ansible.builtin.apt:
+    name: certbot
+    state: present
+
+- name: Check if certificate already exists
+  ansible.builtin.stat:
+    path: "/etc/letsencrypt/live/{{ certbot_domains[0] }}/fullchain.pem"
+  register: certbot_cert
+
+- name: Stop Stalwart for initial cert issuance
+  ansible.builtin.service:
+    name: stalwart
+    state: stopped
+  when: not certbot_cert.stat.exists
+
+- name: Obtain certificate (standalone)
+  ansible.builtin.command:
+    cmd: >
+      certbot certonly --standalone
+      --non-interactive
+      --agree-tos
+      --email {{ certbot_email }}
+      {% for domain in certbot_domains %}-d {{ domain }} {% endfor %}
+  when: not certbot_cert.stat.exists
+  changed_when: true
+
+- name: Start Stalwart after cert issuance
+  ansible.builtin.service:
+    name: stalwart
+    state: started
+  when: not certbot_cert.stat.exists
+
+- name: Grant stalwart read access to certs
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - /etc/letsencrypt/live
+    - /etc/letsencrypt/archive
+
+- name: Deploy Stalwart admin password for renewal hook
+  ansible.builtin.copy:
+    dest: /etc/letsencrypt/.stalwart-admin-pass
+    content: "{{ stalwart_fallback_admin_password }}"
+    owner: root
+    group: root
+    mode: "0600"
+
+- name: Deploy certbot renewal hook
+  ansible.builtin.copy:
+    dest: /etc/letsencrypt/renewal-hooks/deploy/stalwart.sh
+    content: |
+      #!/bin/bash
+      DOMAIN="{{ certbot_domains[0] }}"
+      PASS=$(cat /etc/letsencrypt/.stalwart-admin-pass)
+
+      python3 -c "
+      import json, urllib.request
+
+      cert = open('/etc/letsencrypt/live/$DOMAIN/fullchain.pem').read()
+      key = open('/etc/letsencrypt/live/$DOMAIN/privkey.pem').read()
+      body = json.dumps([{'type':'insert','assert_empty':False,'values':[
+        ['certificate.default.cert', cert],
+        ['certificate.default.private-key', key],
+      ]}]).encode()
+
+      import base64
+      auth = base64.b64encode(('admin:' + open('/etc/letsencrypt/.stalwart-admin-pass').read().strip()).encode()).decode()
+
+      req = urllib.request.Request('http://127.0.0.1:8080/api/settings', data=body,
+        headers={'Content-Type':'application/json','Authorization':'Basic ' + auth}, method='POST')
+      urllib.request.urlopen(req)
+
+      req = urllib.request.Request('http://127.0.0.1:8080/api/reload',
+        headers={'Authorization':'Basic ' + auth})
+      urllib.request.urlopen(req)
+      "
+    mode: "0755"
+
+- name: Ensure certbot renewal timer is enabled
+  ansible.builtin.systemd:
+    name: certbot.timer
+    enabled: true
+    state: started