source: main/waeup-ansible/roles/letsencrypt/tasks/main.yml @ 15284

Last change on this file since 15284 was 14706, checked in by uli, 7 years ago

Add ansible role for installing letsencrypt (LE)

The letsencrypt.yml playbook is there to trigger the
letsencrypt role. It sets some important vars.

Putting all this into an own role might be overkill,
but it is good to have at least something
letsencrypt-related in the repo.

All this might be better placed in a single playbook.

File size: 1.9 KB
Line 
1---
2# tasks to enable letsencrypt on Ubuntu
3#
4# This role expects that you run `nginx` as webserver.
5# This role works on Ubuntu machines.
6# This role expects the following vars to be set:
7# - `letsencrypt_email`  Email address of cert manager
8# - `letsencrypt_domains` List of domains to maintain
9#                         comma-separated, no blanks
10# - `letsencrypt_expand_domains` - true or false
11#                         if true, new domains are added
12#                         to the already existing list of
13#                         certs
14#
15- name: "enable letsencrypt PPA"
16  become: yes
17  apt_repository:
18      repo: 'ppa:certbot/certbot'
19      state: present
20  notify: update package cache
21
22- name: "install certbot"
23  become: yes
24  apt:
25      name: certbot
26      state: present
27
28- name: "register account"
29  become: yes
30  command: certbot register -m "{{ letsencrypt_email }}" --non-interactive --agree-tos -vv
31  args:
32    creates: '/etc/letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory/*/private_key.json'
33
34# For first time creation of certs. Later on use the below task or renewal
35- name: "create initial certs"
36  become: yes
37  command: certbot certonly --standalone --non-interactive -d "{{ letsencrypt_domains }}" --pre-hook "sudo service nginx stop" --post-hook "sudo service nginx start" -m "{{ letsencrypt_email }}" --agree-tos --rsa-key-size 4096
38  args:
39    creates: '/etc/letsencrypt/live/*/cert.pem'
40
41# in case additional domains must be added to the already existing ones
42- name: "create certs (expand list of domains)"
43  become: yes
44  command: certbot certonly --standalone --non-interactive -d "{{ letsencrypt_domains }}" --pre-hook "sudo service nginx stop" --post-hook "sudo service nginx start" -m "{{ letsencrypt_email }}" --agree-tos --expand --rsa-key-size 4096
45  when: letsencrypt_expand_domains
46
47# Cron task for renewal is installed automatically by the Ubuntu package
Note: See TracBrowser for help on using the repository browser.