123 lines
3.2 KiB
YAML
123 lines
3.2 KiB
YAML
---
|
|
- name: Install stuff
|
|
apt:
|
|
name:
|
|
- apache2
|
|
update_cache: yes
|
|
|
|
- name: install acme.sh
|
|
include_role:
|
|
name: acmesh
|
|
|
|
- name: enable apache modules
|
|
command: a2enmod {{ item }}
|
|
args:
|
|
creates: /etc/apache2/mods-enabled/{{ item }}.load
|
|
loop:
|
|
- proxy
|
|
- proxy_html
|
|
- proxy_http
|
|
- proxy_http2
|
|
- proxy_wstunnel
|
|
- ssl
|
|
- headers
|
|
- rewrite
|
|
notify:
|
|
reload apache2
|
|
|
|
- name: create directory for own root ca cert
|
|
file:
|
|
path: "/usr/local/share/ca-certificates/step-ca/"
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
state: directory
|
|
when: acme_sh_server is defined
|
|
|
|
- name: copy own root ca cert
|
|
copy:
|
|
src: "{{ inventory_dir }}/files/root_ca.crt"
|
|
dest: "/usr/local/share/ca-certificates/step-ca/step-ca.crt"
|
|
when: acme_sh_server is defined
|
|
|
|
- name: run update-ca-certificates
|
|
command: /usr/sbin/update-ca-certificates
|
|
args:
|
|
creates: /etc/ssl/certs/step-ca.pem
|
|
when: acme_sh_server is defined
|
|
|
|
- name: normalize website definitions
|
|
set_fact:
|
|
_websites: >-
|
|
{%- set out = [] -%}
|
|
{%- for name, cfg in (websites | default({}, true)).items() -%}
|
|
{%- set c = website_site_defaults | combine(cfg | default({}, true), {'domain': name}) -%}
|
|
{%- set a = c.aliases | default([], true) -%}
|
|
{%- set c = c | combine({'aliases': [a] if a is string else a | list}) -%}
|
|
{%- set _ = out.append(c) -%}
|
|
{%- endfor -%}
|
|
{{ out }}
|
|
_website_without_cert: []
|
|
|
|
- name: create docroot
|
|
file:
|
|
path: "{{ site.docroot }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
state: directory
|
|
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
|
loop_control:
|
|
loop_var: site
|
|
label: "{{ site.domain }}"
|
|
|
|
- name: generate http vhost
|
|
template:
|
|
src: apache.conf.j2
|
|
dest: /etc/apache2/sites-available/{{ site.domain }}.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
|
loop_control:
|
|
loop_var: site
|
|
label: "{{ site.domain }}"
|
|
notify:
|
|
- reload apache2
|
|
|
|
- name: activate http vhost
|
|
file:
|
|
state: link
|
|
src: /etc/apache2/sites-available/{{ site.domain }}.conf
|
|
dest: /etc/apache2/sites-enabled/{{ site.domain }}.conf
|
|
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
|
loop_control:
|
|
loop_var: site
|
|
label: "{{ site.domain }}"
|
|
notify:
|
|
- reload apache2
|
|
|
|
# http vhosts must be live before acme.sh uses the webroot
|
|
- name: Flush handlers
|
|
meta: flush_handlers
|
|
|
|
- name: certificate and ssl vhost
|
|
include_tasks: ssl.yml
|
|
loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
|
|
loop_control:
|
|
loop_var: site
|
|
label: "{{ site.domain }}"
|
|
|
|
- name: remove websites
|
|
include_tasks: absent.yml
|
|
loop: "{{ _websites | selectattr('state', 'eq', 'absent') | list }}"
|
|
loop_control:
|
|
loop_var: site
|
|
label: "{{ site.domain }}"
|
|
|
|
- name: websites without certificate (domain does not reach this host)
|
|
debug:
|
|
msg: "WARNING: no certificate and no ssl vhost for {{ _website_without_cert | join(', ') }} - check DNS and port 80, then rerun"
|
|
when: _website_without_cert | length > 0
|
|
failed_when: website_fail_without_cert | bool
|