mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 02:12:55 +02:00
Ruben Hensen
88 lines
2.6 KiB
YAML
88 lines
2.6 KiB
YAML
---
|
|
- name: Install certbot
|
|
ansible.builtin.apt:
|
|
name: certbot
|
|
state: present
|
|
|
|
- name: Check if certificate already exists
|
|
ansible.builtin.stat:
|
|
path: "/etc/letsencrypt/live/{{ certbot_domains[0] }}/fullchain.pem"
|
|
register: certbot_cert
|
|
|
|
- name: Stop Stalwart for initial cert issuance
|
|
ansible.builtin.service:
|
|
name: stalwart
|
|
state: stopped
|
|
when: not certbot_cert.stat.exists
|
|
|
|
- name: Obtain certificate (standalone)
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
certbot certonly --standalone
|
|
--non-interactive
|
|
--agree-tos
|
|
--email {{ certbot_email }}
|
|
{% for domain in certbot_domains %}-d {{ domain }} {% endfor %}
|
|
when: not certbot_cert.stat.exists
|
|
changed_when: true
|
|
|
|
- name: Start Stalwart after cert issuance
|
|
ansible.builtin.service:
|
|
name: stalwart
|
|
state: started
|
|
when: not certbot_cert.stat.exists
|
|
|
|
- name: Grant stalwart read access to certs
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- /etc/letsencrypt/live
|
|
- /etc/letsencrypt/archive
|
|
|
|
- name: Deploy Stalwart admin password for renewal hook
|
|
ansible.builtin.copy:
|
|
dest: /etc/letsencrypt/.stalwart-admin-pass
|
|
content: "{{ stalwart_fallback_admin_password }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
|
|
- name: Deploy certbot renewal hook
|
|
ansible.builtin.copy:
|
|
dest: /etc/letsencrypt/renewal-hooks/deploy/stalwart.sh
|
|
content: |
|
|
#!/bin/bash
|
|
DOMAIN="{{ certbot_domains[0] }}"
|
|
PASS=$(cat /etc/letsencrypt/.stalwart-admin-pass)
|
|
|
|
python3 -c "
|
|
import json, urllib.request
|
|
|
|
cert = open('/etc/letsencrypt/live/$DOMAIN/fullchain.pem').read()
|
|
key = open('/etc/letsencrypt/live/$DOMAIN/privkey.pem').read()
|
|
body = json.dumps([{'type':'insert','assert_empty':False,'values':[
|
|
['certificate.default.cert', cert],
|
|
['certificate.default.private-key', key],
|
|
]}]).encode()
|
|
|
|
import base64
|
|
auth = base64.b64encode(('admin:' + open('/etc/letsencrypt/.stalwart-admin-pass').read().strip()).encode()).decode()
|
|
|
|
req = urllib.request.Request('http://127.0.0.1:8080/api/settings', data=body,
|
|
headers={'Content-Type':'application/json','Authorization':'Basic ' + auth}, method='POST')
|
|
urllib.request.urlopen(req)
|
|
|
|
req = urllib.request.Request('http://127.0.0.1:8080/api/reload',
|
|
headers={'Authorization':'Basic ' + auth})
|
|
urllib.request.urlopen(req)
|
|
"
|
|
mode: "0755"
|
|
|
|
- name: Ensure certbot renewal timer is enabled
|
|
ansible.builtin.systemd:
|
|
name: certbot.timer
|
|
enabled: true
|
|
state: started
|