383 lines
13 KiB
YAML
383 lines
13 KiB
YAML
---
|
|
# -----------------------------------------------------------------------------
|
|
# Certbot Deployment Playbook
|
|
# -----------------------------------------------------------------------------
|
|
# Deploys certbot with Namecheap DNS-01 validation and requests certificates.
|
|
# Reusable across all certbot hosts (horkos, bootes).
|
|
#
|
|
# Supports two host_vars patterns:
|
|
# Single-cert: certbot_cert_name + certbot_domains (horkos)
|
|
# Multi-cert: certbot_certificates list (bootes)
|
|
#
|
|
# Secrets are fetched automatically from OCI Vault via group_vars/all/secrets.yml
|
|
#
|
|
# Usage:
|
|
# ansible-playbook certbot/deploy.yml --limit horkos.helu.ca
|
|
# ansible-playbook certbot/deploy.yml --limit bootes.helu.ca
|
|
# -----------------------------------------------------------------------------
|
|
|
|
- name: Deploy Certbot with Namecheap DNS-01 Validation
|
|
hosts: ubuntu
|
|
gather_facts: false
|
|
vars:
|
|
ansible_common_remote_group: "{{ certbot_group | default(omit) }}"
|
|
allow_world_readable_tmpfiles: true
|
|
tags: [certbot, ssl, deploy]
|
|
|
|
handlers:
|
|
- name: restart certbot-renew timer
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: certbot-renew.timer
|
|
state: restarted
|
|
daemon_reload: true
|
|
|
|
tasks:
|
|
- name: Check if host has certbot service
|
|
ansible.builtin.set_fact:
|
|
has_certbot_service: "{{ 'certbot' in services | default([]) }}"
|
|
|
|
- name: Skip hosts without certbot service
|
|
ansible.builtin.meta: end_host
|
|
when: not has_certbot_service
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Build Unified Certificate List
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Build unified certificate list from host_vars
|
|
ansible.builtin.set_fact:
|
|
_certbot_certs: >-
|
|
{{ certbot_certificates
|
|
| default([{'cert_name': certbot_cert_name, 'domains': certbot_domains}]) }}
|
|
|
|
# -------------------------------------------------------------------------
|
|
# System Setup
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Create certbot group
|
|
become: true
|
|
ansible.builtin.group:
|
|
name: "{{ certbot_group }}"
|
|
system: true
|
|
|
|
- name: Create certbot user
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: "{{ certbot_user }}"
|
|
comment: "Certbot SSL Certificate Management"
|
|
group: "{{ certbot_group }}"
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
home: "{{ certbot_directory }}"
|
|
create_home: false
|
|
|
|
- name: Add certbot user to ponos group
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: "{{ certbot_user }}"
|
|
groups: ponos
|
|
append: true
|
|
|
|
- name: Add ponos user to certbot group
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: ponos
|
|
groups: "{{ certbot_group }}"
|
|
append: true
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Directory Structure
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Create certbot directories
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
owner: "{{ certbot_user }}"
|
|
group: "{{ certbot_group }}"
|
|
state: directory
|
|
mode: '0750'
|
|
loop:
|
|
- "{{ certbot_directory }}"
|
|
- "{{ certbot_directory }}/config"
|
|
- "{{ certbot_directory }}/work"
|
|
- "{{ certbot_directory }}/logs"
|
|
- "{{ certbot_directory }}/credentials"
|
|
- "{{ certbot_directory }}/hooks"
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Python Virtual Environment
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Install Python venv package
|
|
become: true
|
|
ansible.builtin.apt:
|
|
name:
|
|
- python3-venv
|
|
- python3-pip
|
|
- acl
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Create virtual environment
|
|
become: true
|
|
become_user: "{{ certbot_user }}"
|
|
ansible.builtin.command: python3 -m venv {{ certbot_directory }}/.venv
|
|
args:
|
|
creates: "{{ certbot_directory }}/.venv/bin/activate"
|
|
|
|
- name: Install certbot and Namecheap DNS plugin
|
|
become: true
|
|
become_user: "{{ certbot_user }}"
|
|
ansible.builtin.pip:
|
|
name:
|
|
- pip
|
|
- certbot
|
|
- certbot-dns-namecheap
|
|
state: present
|
|
virtualenv: "{{ certbot_directory }}/.venv"
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Namecheap Credentials
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Get public IP for Namecheap API whitelisting
|
|
ansible.builtin.uri:
|
|
url: https://ifconfig.me/ip
|
|
return_content: true
|
|
register: public_ip_result
|
|
|
|
- name: Set client IP fact
|
|
ansible.builtin.set_fact:
|
|
namecheap_client_ip: "{{ public_ip_result.content | trim }}"
|
|
|
|
- name: Display public IP for Namecheap API whitelisting
|
|
ansible.builtin.debug:
|
|
msg: "Public IP: {{ namecheap_client_ip }} — ensure whitelisted at https://ap.www.namecheap.com/settings/tools/apiaccess/"
|
|
|
|
- name: Template Namecheap credentials
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: namecheap.ini.j2
|
|
dest: "{{ certbot_directory }}/credentials/namecheap.ini"
|
|
owner: "{{ certbot_user }}"
|
|
group: "{{ certbot_group }}"
|
|
mode: '0600'
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Renewal Hooks
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Template renewal hook script
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: renewal-hook.sh.j2
|
|
dest: "{{ certbot_directory }}/hooks/renewal-hook.sh"
|
|
owner: "{{ certbot_user }}"
|
|
group: "{{ certbot_group }}"
|
|
mode: '0750'
|
|
|
|
- name: Create Prometheus textfile directory
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ prometheus_node_exporter_text_directory }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Template certificate metrics script
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: cert-metrics.sh.j2
|
|
dest: "{{ certbot_directory }}/hooks/cert-metrics.sh"
|
|
owner: "{{ certbot_user }}"
|
|
group: "{{ certbot_group }}"
|
|
mode: '0750'
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Certificate Requests
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Check if certificates already exist
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: "{{ certbot_directory }}/config/live/{{ item.cert_name }}/fullchain.pem"
|
|
register: cert_check
|
|
loop: "{{ _certbot_certs }}"
|
|
loop_control:
|
|
label: "{{ item.cert_name }}"
|
|
|
|
- name: Get current certificate domains
|
|
become: true
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
openssl x509 -in {{ certbot_directory }}/config/live/{{ item.item.cert_name }}/fullchain.pem \
|
|
-noout -ext subjectAltName | \
|
|
grep -oP 'DNS:\K[^,\s]+' | sort
|
|
args:
|
|
executable: /bin/bash
|
|
register: cert_domains
|
|
loop: "{{ cert_check.results }}"
|
|
when: item.stat.exists
|
|
changed_when: false
|
|
loop_control:
|
|
label: "{{ item.item.cert_name }}"
|
|
|
|
- name: Determine which certificates need requesting
|
|
ansible.builtin.set_fact:
|
|
_certs_to_request: >-
|
|
{{ _certs_to_request | default([]) + [
|
|
item.0.item | combine({
|
|
'needs_request': not item.0.stat.exists,
|
|
'domains_changed': item.0.stat.exists and
|
|
(item.1.stdout_lines | default([]) | sort) != (item.0.item.domains | sort)
|
|
})
|
|
] }}
|
|
loop: "{{ cert_check.results | zip_longest(cert_domains.results | default([]), fillvalue={}) | list }}"
|
|
loop_control:
|
|
label: "{{ item.0.item.cert_name }}"
|
|
|
|
- name: Request certificates
|
|
become: true
|
|
become_user: "{{ certbot_user }}"
|
|
ansible.builtin.shell: |
|
|
source {{ certbot_directory }}/.venv/bin/activate
|
|
certbot certonly \
|
|
--non-interactive \
|
|
--agree-tos \
|
|
--email {{ certbot_email }} \
|
|
--authenticator dns-namecheap \
|
|
--dns-namecheap-credentials {{ certbot_directory }}/credentials/namecheap.ini \
|
|
--dns-namecheap-propagation-seconds 120 \
|
|
--config-dir {{ certbot_directory }}/config \
|
|
--work-dir {{ certbot_directory }}/work \
|
|
--logs-dir {{ certbot_directory }}/logs \
|
|
--cert-name {{ item.cert_name }} \
|
|
{{ '--force-renewal' if item.domains_changed | default(false) else '' }} \
|
|
{{ item.domains | map('regex_replace', '^', '-d ') | join(' ') }}
|
|
args:
|
|
executable: /bin/bash
|
|
loop: "{{ _certs_to_request | selectattr('needs_request') | list +
|
|
_certs_to_request | selectattr('domains_changed') | list }}"
|
|
loop_control:
|
|
label: "{{ item.cert_name }}"
|
|
register: certbot_requests
|
|
|
|
- name: Run renewal hook after certificate requests
|
|
become: true
|
|
ansible.builtin.command: "{{ certbot_directory }}/hooks/renewal-hook.sh"
|
|
environment:
|
|
RENEWED_LINEAGE: "{{ certbot_directory }}/config/live/{{ item.item.cert_name }}"
|
|
loop: "{{ certbot_requests.results | default([]) }}"
|
|
when: item.changed | default(false)
|
|
loop_control:
|
|
label: "{{ item.item.cert_name }}"
|
|
|
|
- name: Check if HAProxy PEM exists
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: "{{ haproxy_cert_path }}"
|
|
register: _haproxy_pem_check
|
|
when: haproxy_cert_path is defined
|
|
|
|
- name: Ensure HAProxy PEM is current
|
|
become: true
|
|
ansible.builtin.command: "{{ certbot_directory }}/hooks/renewal-hook.sh"
|
|
environment:
|
|
RENEWED_LINEAGE: "{{ certbot_directory }}/config/live/{{ _certbot_certs[0].cert_name }}"
|
|
when:
|
|
- haproxy_cert_path is defined
|
|
- not (_haproxy_pem_check.stat.exists | default(false))
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Systemd Timer for Auto-Renewal
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Create certbot renewal service
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: |
|
|
[Unit]
|
|
Description=Certbot Renewal
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User={{ certbot_user }}
|
|
Group={{ certbot_group }}
|
|
ExecStart=/bin/bash -c 'source {{ certbot_directory }}/.venv/bin/activate && certbot renew --config-dir {{ certbot_directory }}/config --work-dir {{ certbot_directory }}/work --logs-dir {{ certbot_directory }}/logs --deploy-hook {{ certbot_directory }}/hooks/renewal-hook.sh'
|
|
PrivateTmp=true
|
|
dest: /etc/systemd/system/certbot-renew.service
|
|
mode: '0644'
|
|
notify: restart certbot-renew timer
|
|
|
|
- name: Create certbot renewal timer
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: |
|
|
[Unit]
|
|
Description=Check certbot certificates and renew if expiring
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 00,12:00:00
|
|
RandomizedDelaySec=3600
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
dest: /etc/systemd/system/certbot-renew.timer
|
|
mode: '0644'
|
|
notify: restart certbot-renew timer
|
|
|
|
- name: Enable and start certbot renewal timer
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: certbot-renew.timer
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Initial Metrics Update
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Run certificate metrics script
|
|
become: true
|
|
ansible.builtin.command: "{{ certbot_directory }}/hooks/cert-metrics.sh"
|
|
changed_when: false
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Verification
|
|
# -------------------------------------------------------------------------
|
|
|
|
- name: Verify certificates exist
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: "{{ certbot_directory }}/config/live/{{ item.cert_name }}/fullchain.pem"
|
|
register: final_certs
|
|
loop: "{{ _certbot_certs }}"
|
|
loop_control:
|
|
label: "{{ item.cert_name }}"
|
|
|
|
- name: Certificate deployment status
|
|
ansible.builtin.debug:
|
|
msg: "{{ item.item.cert_name }}: {{ 'deployed' if item.stat.exists else 'MISSING' }}"
|
|
loop: "{{ final_certs.results }}"
|
|
loop_control:
|
|
label: "{{ item.item.cert_name }}"
|
|
|
|
- name: Verify HAProxy combined PEM exists
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: "{{ haproxy_cert_path }}"
|
|
register: _haproxy_pem
|
|
when: haproxy_cert_path is defined
|
|
|
|
- name: HAProxy PEM status
|
|
ansible.builtin.debug:
|
|
msg: "HAProxy PEM {{ haproxy_cert_path }}: {{ 'present' if _haproxy_pem.stat.exists else 'MISSING — renewal hook may have failed' }}"
|
|
when: haproxy_cert_path is defined and _haproxy_pem is defined
|