From 9f608c886d9b2bb8a41172bcdf94634f1633d6bb Mon Sep 17 00:00:00 2001 From: Kishi Date: Tue, 11 Sep 2018 13:58:24 +0200 Subject: [PATCH] Change certificate locations, update powerdns aliases --- roles/acme/defaults/main.yml | 6 ++++++ roles/acme/files/reload.sh | 5 +++++ roles/acme/tasks/main.yml | 11 +++++++++-- roles/acme/templates/acme.sh.request.j2 | 7 +++++-- 4 files changed, 25 insertions(+), 4 deletions(-) diff --git a/roles/acme/defaults/main.yml b/roles/acme/defaults/main.yml index dc7ceb0..daf80dd 100644 --- a/roles/acme/defaults/main.yml +++ b/roles/acme/defaults/main.yml @@ -8,3 +8,9 @@ acme_nsupdate_server: "neon.binary-kitchen.net" acme_sh_url: "https://raw.githubusercontent.com/Neilpang/acme.sh/master/acme.sh" acme_dns_nsupdate_url: "https://raw.githubusercontent.com/Neilpang/acme.sh/master/dnsapi/dns_nsupdate.sh" + +acme_reloadcmd: "/etc/ssl/private/reload.sh" +acme_key: "/etc/ssl/private/host.key" +acme_cert: "/etc/ssl/private/host.cert" +acme_ca: "/etc/ssl/private/host.ca" +acme_fullchain: "/etc/ssl/private/host.fullchain" diff --git a/roles/acme/files/reload.sh b/roles/acme/files/reload.sh index e69de29..dd0b836 100755 --- a/roles/acme/files/reload.sh +++ b/roles/acme/files/reload.sh @@ -0,0 +1,5 @@ +#!/bin/bash +[ -d '/etc/reload.d' ] && for x in "/etc/reload.d/"*; do + [ -e "$x" ] && "$x" +done +exit 0 diff --git a/roles/acme/tasks/main.yml b/roles/acme/tasks/main.yml index 21b567f..d52a5c8 100644 --- a/roles/acme/tasks/main.yml +++ b/roles/acme/tasks/main.yml @@ -11,6 +11,13 @@ changed_when: "False" delegate_to: "{{ acme_nsupdate_server }}" +- name: Update updatepolicy.aliases + lineinfile: + path: "/etc/powerdns/updatepolicy.aliases" + regexp: '^alias\["{{ inventory_hostname}}\."\]' + line: 'alias["{{ inventory_hostname }}."] = {"{{ ''.","''.join(acme_san_domains) }}."} ' + delegate_to: "{{ acme_nsupdate_server }}" + - name: Generate nsupdate.key shell: "pdnsutil generate-tsig-key 'acme-{{ inventory_hostname }}.' '{{ acme_nsupdate_keyalgo }}'" register: "pdns_nsupdate_genkey" @@ -69,11 +76,11 @@ - name: Copy reload.sh copy: src: "reload.sh" - dest: "{{ acme_home }}/{{ inventory_hostname }}/reload.sh" + dest: "{{ acme_reloadcmd }}" mode: "0755" - name: Issue certificate shell: "{{ lookup('template','acme.sh.request.j2').replace('\n',' ') }}" args: chdir: "{{ acme_home }}" - creates: "{{ acme_home }}/{{ inventory_hostname }}/{{ inventory_hostname }}.key" + creates: "{{ acme_cert }}" diff --git a/roles/acme/templates/acme.sh.request.j2 b/roles/acme/templates/acme.sh.request.j2 index 53358e3..ff05d11 100644 --- a/roles/acme/templates/acme.sh.request.j2 +++ b/roles/acme/templates/acme.sh.request.j2 @@ -2,7 +2,6 @@ NSUPDATE_KEY="{{ acme_nsupdate_key }}" NSUPDATE_SERVER="{{ acme_nsupdate_server }}" "{{ acme_home }}/acme.sh" --home "{{ acme_home }}" ---reloadCmd "{{ acme_home }}/{{ inventory_hostname }}/reload.sh" --log --issue -k 4096 @@ -16,4 +15,8 @@ NSUPDATE_SERVER="{{ acme_nsupdate_server }}" {% if acme_staging is defined and acme_staging %} --staging {% endif %} -; +--cert-file "{{ acme_cert }}" +--key-file "{{ acme_key }}" +--ca-file "{{ acme_ca }}" +--fullchain-file "{{ acme_fullchain }}" +--reloadcmd "{{ acme_reloadcmd }}"