[WIP] role for pizza

roles/pizza/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+
+pizza_domain: pizza.binary.kitchen

roles/pizza/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+
+- name: Restart nginx
+  service: name=nginx state=restarted
+
+- name: Run acertmgr
+  command: /usr/bin/acertmgr

roles/pizza/meta/main.yml

@@ -0,0 +1,4 @@
+---
+
+dependencies:
+- { role: acertmgr }

roles/pizza/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+
+#- name: Ensure certificates are available
+#  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ pizza_domain }}.key -out /etc/nginx/ssl/{{ pizza_domain }}.crt -days 730 -subj "/CN={{ pizza_domain }}" creates=/etc/nginx/ssl/{{ pizza_domain }}.crt
+#  notify: Restart nginx
+
+- name: Request nsupdate key for certificate
+  include_role: name=acme-dnskey-generate
+  vars:
+    acme_dnskey_san_domains:
+    - "{{ pizza_domain }}"
+
+- name: Configure certificate manager for pizza
+  template: src=certs.j2 dest=/etc/acertmgr/{{ pizza_domain }}.conf
+  notify: Run acertmgr

roles/pizza/templates/certs.j2

@@ -0,0 +1,18 @@
+---
+
+{{ pizza_domain }}:
+- mode: dns.nsupdate
+  nsupdate_server: {{ acme_dnskey_server }}
+  nsupdate_keyfile: {{ acme_dnskey_file }}
+- path: /etc/nginx/ssl/{{ pizza_domain }}.key
+  user: root
+  group: root
+  perm: '400'
+  format: key
+  action: '/usr/sbin/service nginx restart'
+- path: /etc/nginx/ssl/{{ pizza_domain }}.crt
+  user: root
+  group: root
+  perm: '400'
+  format: crt,ca
+  action: '/usr/sbin/service nginx restart'