From b5419c08b667f96528ff46e99e229a4fe427acec Mon Sep 17 00:00:00 2001 From: Alexander Gabriel Date: Wed, 14 Oct 2026 20:39:34 +0200 Subject: [PATCH] updated websites --- tasks/main.yml | 125 ++-------------------------------------------- tasks/website.yml | 122 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 126 insertions(+), 121 deletions(-) create mode 100644 tasks/website.yml diff --git a/tasks/main.yml b/tasks/main.yml index 8f4b02e..6f82e16 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,122 +1,5 @@ --- -- name: Install stuff - apt: - name: - - apache2 - update_cache: yes - -- name: install acme.sh - include_role: - name: acmesh - -- name: enable apache modules - command: a2enmod {{ item }} - args: - creates: /etc/apache2/mods-enabled/{{ item }}.load - loop: - - proxy - - proxy_html - - proxy_http - - proxy_http2 - - proxy_wstunnel - - ssl - - headers - - rewrite - notify: - reload apache2 - -- name: create directory for own root ca cert - file: - path: "/usr/local/share/ca-certificates/step-ca/" - owner: root - group: root - mode: '0755' - state: directory - when: acme_sh_server is defined - -- name: copy own root ca cert - copy: - src: "{{ inventory_dir }}/files/root_ca.crt" - dest: "/usr/local/share/ca-certificates/step-ca/step-ca.crt" - when: acme_sh_server is defined - -- name: run update-ca-certificates - command: /usr/sbin/update-ca-certificates - args: - creates: /etc/ssl/certs/step-ca.pem - when: acme_sh_server is defined - -- name: normalize website definitions - set_fact: - _websites: >- - {%- set out = [] -%} - {%- for name, cfg in (websites | default({}, true)).items() -%} - {%- set c = website_site_defaults | combine(cfg | default({}, true), {'domain': name}) -%} - {%- set a = c.aliases | default([], true) -%} - {%- set c = c | combine({'aliases': [a] if a is string else a | list}) -%} - {%- set _ = out.append(c) -%} - {%- endfor -%} - {{ out }} - _website_without_cert: [] - -- name: create docroot - file: - path: "{{ site.docroot }}" - owner: root - group: root - mode: '0755' - state: directory - loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" - loop_control: - loop_var: site - label: "{{ site.domain }}" - -- name: generate http vhost - template: - src: apache.conf.j2 - dest: /etc/apache2/sites-available/{{ site.domain }}.conf - owner: root - group: root - mode: "0644" - loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" - loop_control: - loop_var: site - label: "{{ site.domain }}" - notify: - - reload apache2 - -- name: activate http vhost - file: - state: link - src: /etc/apache2/sites-available/{{ site.domain }}.conf - dest: /etc/apache2/sites-enabled/{{ site.domain }}.conf - loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" - loop_control: - loop_var: site - label: "{{ site.domain }}" - notify: - - reload apache2 - -# http vhosts must be live before acme.sh uses the webroot -- name: Flush handlers - meta: flush_handlers - -- name: certificate and ssl vhost - include_tasks: ssl.yml - loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" - loop_control: - loop_var: site - label: "{{ site.domain }}" - -- name: remove websites - include_tasks: absent.yml - loop: "{{ _websites | selectattr('state', 'eq', 'absent') | list }}" - loop_control: - loop_var: site - label: "{{ site.domain }}" - -- name: websites without certificate (domain does not reach this host) - debug: - msg: "WARNING: no certificate and no ssl vhost for {{ _website_without_cert | join(', ') }} - check DNS and port 80, then rerun" - when: _website_without_cert | length > 0 - failed_when: website_fail_without_cert | bool +# only do something if websites are configured for this host +- name: configure websites + include_tasks: website.yml + when: websites | default({}, true) | length > 0 diff --git a/tasks/website.yml b/tasks/website.yml new file mode 100644 index 0000000..8f4b02e --- /dev/null +++ b/tasks/website.yml @@ -0,0 +1,122 @@ +--- +- name: Install stuff + apt: + name: + - apache2 + update_cache: yes + +- name: install acme.sh + include_role: + name: acmesh + +- name: enable apache modules + command: a2enmod {{ item }} + args: + creates: /etc/apache2/mods-enabled/{{ item }}.load + loop: + - proxy + - proxy_html + - proxy_http + - proxy_http2 + - proxy_wstunnel + - ssl + - headers + - rewrite + notify: + reload apache2 + +- name: create directory for own root ca cert + file: + path: "/usr/local/share/ca-certificates/step-ca/" + owner: root + group: root + mode: '0755' + state: directory + when: acme_sh_server is defined + +- name: copy own root ca cert + copy: + src: "{{ inventory_dir }}/files/root_ca.crt" + dest: "/usr/local/share/ca-certificates/step-ca/step-ca.crt" + when: acme_sh_server is defined + +- name: run update-ca-certificates + command: /usr/sbin/update-ca-certificates + args: + creates: /etc/ssl/certs/step-ca.pem + when: acme_sh_server is defined + +- name: normalize website definitions + set_fact: + _websites: >- + {%- set out = [] -%} + {%- for name, cfg in (websites | default({}, true)).items() -%} + {%- set c = website_site_defaults | combine(cfg | default({}, true), {'domain': name}) -%} + {%- set a = c.aliases | default([], true) -%} + {%- set c = c | combine({'aliases': [a] if a is string else a | list}) -%} + {%- set _ = out.append(c) -%} + {%- endfor -%} + {{ out }} + _website_without_cert: [] + +- name: create docroot + file: + path: "{{ site.docroot }}" + owner: root + group: root + mode: '0755' + state: directory + loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" + loop_control: + loop_var: site + label: "{{ site.domain }}" + +- name: generate http vhost + template: + src: apache.conf.j2 + dest: /etc/apache2/sites-available/{{ site.domain }}.conf + owner: root + group: root + mode: "0644" + loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" + loop_control: + loop_var: site + label: "{{ site.domain }}" + notify: + - reload apache2 + +- name: activate http vhost + file: + state: link + src: /etc/apache2/sites-available/{{ site.domain }}.conf + dest: /etc/apache2/sites-enabled/{{ site.domain }}.conf + loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" + loop_control: + loop_var: site + label: "{{ site.domain }}" + notify: + - reload apache2 + +# http vhosts must be live before acme.sh uses the webroot +- name: Flush handlers + meta: flush_handlers + +- name: certificate and ssl vhost + include_tasks: ssl.yml + loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}" + loop_control: + loop_var: site + label: "{{ site.domain }}" + +- name: remove websites + include_tasks: absent.yml + loop: "{{ _websites | selectattr('state', 'eq', 'absent') | list }}" + loop_control: + loop_var: site + label: "{{ site.domain }}" + +- name: websites without certificate (domain does not reach this host) + debug: + msg: "WARNING: no certificate and no ssl vhost for {{ _website_without_cert | join(', ') }} - check DNS and port 80, then rerun" + when: _website_without_cert | length > 0 + failed_when: website_fail_without_cert | bool