feat: acme.sh renewal

roles/acme_sh/tasks/acme_sh_renew.yml

@@ -0,0 +1,17 @@
+---
+- name: Copy {{ acme_sh_hostname }} templated scripts
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: /usr/local/bin/{{ item }}
+    mode: +x
+  loop:
+    - docker-acmesh-renew
+    - docker-acmesh-list
+
+- name: Register renew certs job
+  ansible.builtin.cron:
+    name: Renew certs for {{ nginx_hostname }}
+    minute: "{{ 59 |random(seed=nginx_hostname) }}"
+    hour: "0"
+    weekday: "0"
+    job: docker-acmesh-renew && docker restart {{ nginx_hostname }}; write-node-exporter-metric -c "Renew certs for {{ nginx_hostname }}" -v $?

roles/acme_sh/tasks/main.yml

@@ -4,3 +4,9 @@
   when: acme_sh_hostname is defined
   tags:
     - acme_sh
+
+- name: Include {{ role_name }} renew tasks
+  ansible.builtin.include_tasks: "{{ role_name }}_renew.yml"
+  when: acme_sh_hostname is defined
+  tags:
+    - acme_sh

roles/acme_sh/templates/docker-acmesh-list

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+docker run --rm --name {{ acme_sh_hostname }}-tmp \
+--volume "{{ acme_sh_data_dir }}:/acme.sh" \
+{{ acme_sh_image }} \
+--list

roles/acme_sh/templates/docker-acmesh-renew

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+{% if acme_sh_freedns_user is defined and acme_sh_freedns_password is defined %}
+docker run --rm --name {{ acme_sh_hostname }}-tmp \
+--volume "{{ acme_sh_data_dir }}:/acme.sh" \
+--env "FREEDNS_User={{ acme_sh_freedns_user }}" \
+---env "FREEDNS_Password={{ acme_sh_freedns_password }}" \
+{{ acme_sh_image }} \
+--renew {% for item in acme_sh_certs %}-d {{ item.src_hostname }} {% endfor %}
+{% endif %}

roles/certbot/tasks/certbot.yml

@@ -4,15 +4,6 @@
     path: "{{ nginx_data_dir }}/proxies"
     state: directory
 
-- name: Copy {{ certbot_hostname }} templated scripts
-  ansible.builtin.template:
-    src: "{{ item }}"
-    dest: /usr/local/bin/{{ item }}
-    mode: +x
-  loop:
-    - docker-certbot-renew
-    - docker-certbot-list
-
 - name: Copy {{ role_name }} scripts
   ansible.builtin.copy:
     src: "{{ item }}"

roles/certbot/tasks/certbot_renew.yml

@@ -1,4 +1,13 @@
 ---
+- name: Copy {{ certbot_hostname }} templated scripts
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: /usr/local/bin/{{ item }}
+    mode: +x
+  loop:
+    - docker-certbot-renew
+    - docker-certbot-list
+
 - name: Register renew certs job
   ansible.builtin.cron:
     name: Renew certs for {{ nginx_hostname }}

roles/clean/tasks/main.yml

@@ -1,10 +1,10 @@
 ---
 - name: Include cleanup tasks
   ansible.builtin.include_tasks: "{{ item }}.yml"
-  when: item in tasks
+  when: item in ansible_tags
   loop: "{{ ansible_run_tags }}"
   vars:
-    tasks:
+    ansible_tags:
       - certbot
       - nginx
       - modsecurity

roles/debug/tasks/debug.yml

@@ -6,7 +6,7 @@
 
 # - name: Collect bouncer keys
 #   set_fact:
-#     bouncer_key_env: "{{ 
+#     bouncer_key_env: "{{
 #       groups['all'] | map('extract', hostvars) |
 #       json_query('[?crowdsec_firewall_bouncer_enabled && crowdsec_firewall_bouncer_enabled==`true`].{key: inventory_hostname, value: vault_crowdsec_firewall_bouncer_key}') |
 #       list

roles/odoo/tasks/odoo.yml

@@ -73,6 +73,7 @@
       LIST_DB: "{{ odoo_list_db }}"
       PROXY_MODE: "{{ odoo_proxy_mode }}"
       PIP_INSTALL: "{{ odoo_pip_install | default('') }}"
+      WORKERS: "{{ odoo_workers | int }}"
     ports: "{{ odoo_ports | default([]) }}"
     volumes: "{{ odoo_volumes }}"
     networks:

roles/odoo_apps/tasks/odoo_apps.yml

@@ -44,8 +44,6 @@
     dest: "{{ odoo_apps_tmp_dir }}"
     remote_src: true
     list_files: true
-  # args:
-  #   creates: "{{ odoo_apps_tmp_dir }}/{{ item.name }}-{{ item.version }}"
   loop: "{{ downloaded_apps }}"
   when: item.changed