updated websites
This commit is contained in:
parent
da1b2cfe82
commit
b5419c08b6
125
tasks/main.yml
125
tasks/main.yml
@ -1,122 +1,5 @@
|
||||
---
|
||||
- name: Install stuff
|
||||
apt:
|
||||
name:
|
||||
- apache2
|
||||
update_cache: yes
|
||||
|
||||
- name: install acme.sh
|
||||
include_role:
|
||||
name: acmesh
|
||||
|
||||
- name: enable apache modules
|
||||
command: a2enmod {{ item }}
|
||||
args:
|
||||
creates: /etc/apache2/mods-enabled/{{ item }}.load
|
||||
loop:
|
||||
- proxy
|
||||
- proxy_html
|
||||
- proxy_http
|
||||
- proxy_http2
|
||||
- proxy_wstunnel
|
||||
- ssl
|
||||
- headers
|
||||
- rewrite
|
||||
notify:
|
||||
reload apache2
|
||||
|
||||
- name: create directory for own root ca cert
|
||||
file:
|
||||
path: "/usr/local/share/ca-certificates/step-ca/"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
when: acme_sh_server is defined
|
||||
|
||||
- name: copy own root ca cert
|
||||
copy:
|
||||
src: "{{ inventory_dir }}/files/root_ca.crt"
|
||||
dest: "/usr/local/share/ca-certificates/step-ca/step-ca.crt"
|
||||
when: acme_sh_server is defined
|
||||
|
||||
- name: run update-ca-certificates
|
||||
command: /usr/sbin/update-ca-certificates
|
||||
args:
|
||||
creates: /etc/ssl/certs/step-ca.pem
|
||||
when: acme_sh_server is defined
|
||||
|
||||
- name: normalize website definitions
|
||||
set_fact:
|
||||
_websites: >-
|
||||
{%- set out = [] -%}
|
||||
{%- for name, cfg in (websites | default({}, true)).items() -%}
|
||||
{%- set c = website_site_defaults | combine(cfg | default({}, true), {'domain': name}) -%}
|
||||
{%- set a = c.aliases | default([], true) -%}
|
||||
{%- set c = c | combine({'aliases': [a] if a is string else a | list}) -%}
|
||||
{%- set _ = out.append(c) -%}
|
||||
{%- endfor -%}
|
||||
{{ out }}
|
||||
_website_without_cert: []
|
||||
|
||||
- name: create docroot
|
||||
file:
|
||||
path: "{{ site.docroot }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
|
||||
- name: generate http vhost
|
||||
template:
|
||||
src: apache.conf.j2
|
||||
dest: /etc/apache2/sites-available/{{ site.domain }}.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
notify:
|
||||
- reload apache2
|
||||
|
||||
- name: activate http vhost
|
||||
file:
|
||||
state: link
|
||||
src: /etc/apache2/sites-available/{{ site.domain }}.conf
|
||||
dest: /etc/apache2/sites-enabled/{{ site.domain }}.conf
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
notify:
|
||||
- reload apache2
|
||||
|
||||
# http vhosts must be live before acme.sh uses the webroot
|
||||
- name: Flush handlers
|
||||
meta: flush_handlers
|
||||
|
||||
- name: certificate and ssl vhost
|
||||
include_tasks: ssl.yml
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
|
||||
- name: remove websites
|
||||
include_tasks: absent.yml
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'absent') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
|
||||
- name: websites without certificate (domain does not reach this host)
|
||||
debug:
|
||||
msg: "WARNING: no certificate and no ssl vhost for {{ _website_without_cert | join(', ') }} - check DNS and port 80, then rerun"
|
||||
when: _website_without_cert | length > 0
|
||||
failed_when: website_fail_without_cert | bool
|
||||
# only do something if websites are configured for this host
|
||||
- name: configure websites
|
||||
include_tasks: website.yml
|
||||
when: websites | default({}, true) | length > 0
|
||||
|
||||
122
tasks/website.yml
Normal file
122
tasks/website.yml
Normal file
@ -0,0 +1,122 @@
|
||||
---
|
||||
- name: Install stuff
|
||||
apt:
|
||||
name:
|
||||
- apache2
|
||||
update_cache: yes
|
||||
|
||||
- name: install acme.sh
|
||||
include_role:
|
||||
name: acmesh
|
||||
|
||||
- name: enable apache modules
|
||||
command: a2enmod {{ item }}
|
||||
args:
|
||||
creates: /etc/apache2/mods-enabled/{{ item }}.load
|
||||
loop:
|
||||
- proxy
|
||||
- proxy_html
|
||||
- proxy_http
|
||||
- proxy_http2
|
||||
- proxy_wstunnel
|
||||
- ssl
|
||||
- headers
|
||||
- rewrite
|
||||
notify:
|
||||
reload apache2
|
||||
|
||||
- name: create directory for own root ca cert
|
||||
file:
|
||||
path: "/usr/local/share/ca-certificates/step-ca/"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
when: acme_sh_server is defined
|
||||
|
||||
- name: copy own root ca cert
|
||||
copy:
|
||||
src: "{{ inventory_dir }}/files/root_ca.crt"
|
||||
dest: "/usr/local/share/ca-certificates/step-ca/step-ca.crt"
|
||||
when: acme_sh_server is defined
|
||||
|
||||
- name: run update-ca-certificates
|
||||
command: /usr/sbin/update-ca-certificates
|
||||
args:
|
||||
creates: /etc/ssl/certs/step-ca.pem
|
||||
when: acme_sh_server is defined
|
||||
|
||||
- name: normalize website definitions
|
||||
set_fact:
|
||||
_websites: >-
|
||||
{%- set out = [] -%}
|
||||
{%- for name, cfg in (websites | default({}, true)).items() -%}
|
||||
{%- set c = website_site_defaults | combine(cfg | default({}, true), {'domain': name}) -%}
|
||||
{%- set a = c.aliases | default([], true) -%}
|
||||
{%- set c = c | combine({'aliases': [a] if a is string else a | list}) -%}
|
||||
{%- set _ = out.append(c) -%}
|
||||
{%- endfor -%}
|
||||
{{ out }}
|
||||
_website_without_cert: []
|
||||
|
||||
- name: create docroot
|
||||
file:
|
||||
path: "{{ site.docroot }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
|
||||
- name: generate http vhost
|
||||
template:
|
||||
src: apache.conf.j2
|
||||
dest: /etc/apache2/sites-available/{{ site.domain }}.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
notify:
|
||||
- reload apache2
|
||||
|
||||
- name: activate http vhost
|
||||
file:
|
||||
state: link
|
||||
src: /etc/apache2/sites-available/{{ site.domain }}.conf
|
||||
dest: /etc/apache2/sites-enabled/{{ site.domain }}.conf
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
notify:
|
||||
- reload apache2
|
||||
|
||||
# http vhosts must be live before acme.sh uses the webroot
|
||||
- name: Flush handlers
|
||||
meta: flush_handlers
|
||||
|
||||
- name: certificate and ssl vhost
|
||||
include_tasks: ssl.yml
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
|
||||
- name: remove websites
|
||||
include_tasks: absent.yml
|
||||
loop: "{{ _websites | selectattr('state', 'eq', 'absent') | list }}"
|
||||
loop_control:
|
||||
loop_var: site
|
||||
label: "{{ site.domain }}"
|
||||
|
||||
- name: websites without certificate (domain does not reach this host)
|
||||
debug:
|
||||
msg: "WARNING: no certificate and no ssl vhost for {{ _website_without_cert | join(', ') }} - check DNS and port 80, then rerun"
|
||||
when: _website_without_cert | length > 0
|
||||
failed_when: website_fail_without_cert | bool
|
||||
Loading…
Reference in New Issue
Block a user