From b605de6e372c8cde6fcdbae370ee83e1c49cdac8 Mon Sep 17 00:00:00 2001 From: Janik von Rotz Date: Wed, 4 Dec 2024 09:02:47 +0100 Subject: [PATCH] feat: acme.sh renewal --- roles/acme_sh/tasks/acme_sh_renew.yml | 17 +++++++++++++++++ roles/acme_sh/tasks/main.yml | 6 ++++++ roles/acme_sh/templates/docker-acmesh-list | 6 ++++++ roles/acme_sh/templates/docker-acmesh-renew | 10 ++++++++++ roles/certbot/tasks/certbot.yml | 9 --------- roles/certbot/tasks/certbot_renew.yml | 9 +++++++++ roles/clean/tasks/main.yml | 4 ++-- roles/debug/tasks/debug.yml | 2 +- roles/odoo/tasks/odoo.yml | 1 + roles/odoo_apps/tasks/odoo_apps.yml | 2 -- 10 files changed, 52 insertions(+), 14 deletions(-) create mode 100644 roles/acme_sh/tasks/acme_sh_renew.yml create mode 100755 roles/acme_sh/templates/docker-acmesh-list create mode 100755 roles/acme_sh/templates/docker-acmesh-renew diff --git a/roles/acme_sh/tasks/acme_sh_renew.yml b/roles/acme_sh/tasks/acme_sh_renew.yml new file mode 100644 index 00000000..af894a0c --- /dev/null +++ b/roles/acme_sh/tasks/acme_sh_renew.yml @@ -0,0 +1,17 @@ +--- +- name: Copy {{ acme_sh_hostname }} templated scripts + ansible.builtin.template: + src: "{{ item }}" + dest: /usr/local/bin/{{ item }} + mode: +x + loop: + - docker-acmesh-renew + - docker-acmesh-list + +- name: Register renew certs job + ansible.builtin.cron: + name: Renew certs for {{ nginx_hostname }} + minute: "{{ 59 |random(seed=nginx_hostname) }}" + hour: "0" + weekday: "0" + job: docker-acmesh-renew && docker restart {{ nginx_hostname }}; write-node-exporter-metric -c "Renew certs for {{ nginx_hostname }}" -v $? diff --git a/roles/acme_sh/tasks/main.yml b/roles/acme_sh/tasks/main.yml index bae6abd2..a1ad7c19 100644 --- a/roles/acme_sh/tasks/main.yml +++ b/roles/acme_sh/tasks/main.yml @@ -4,3 +4,9 @@ when: acme_sh_hostname is defined tags: - acme_sh + +- name: Include {{ role_name }} renew tasks + ansible.builtin.include_tasks: "{{ role_name }}_renew.yml" + when: acme_sh_hostname is defined + tags: + - acme_sh diff --git a/roles/acme_sh/templates/docker-acmesh-list b/roles/acme_sh/templates/docker-acmesh-list new file mode 100755 index 00000000..9beca06d --- /dev/null +++ b/roles/acme_sh/templates/docker-acmesh-list @@ -0,0 +1,6 @@ +#!/bin/bash + +docker run --rm --name {{ acme_sh_hostname }}-tmp \ +--volume "{{ acme_sh_data_dir }}:/acme.sh" \ +{{ acme_sh_image }} \ +--list diff --git a/roles/acme_sh/templates/docker-acmesh-renew b/roles/acme_sh/templates/docker-acmesh-renew new file mode 100755 index 00000000..c3a606cb --- /dev/null +++ b/roles/acme_sh/templates/docker-acmesh-renew @@ -0,0 +1,10 @@ +#!/bin/bash + +{% if acme_sh_freedns_user is defined and acme_sh_freedns_password is defined %} +docker run --rm --name {{ acme_sh_hostname }}-tmp \ +--volume "{{ acme_sh_data_dir }}:/acme.sh" \ +--env "FREEDNS_User={{ acme_sh_freedns_user }}" \ +---env "FREEDNS_Password={{ acme_sh_freedns_password }}" \ +{{ acme_sh_image }} \ +--renew {% for item in acme_sh_certs %}-d {{ item.src_hostname }} {% endfor %} +{% endif %} diff --git a/roles/certbot/tasks/certbot.yml b/roles/certbot/tasks/certbot.yml index d41b3b60..43bf3eb9 100644 --- a/roles/certbot/tasks/certbot.yml +++ b/roles/certbot/tasks/certbot.yml @@ -4,15 +4,6 @@ path: "{{ nginx_data_dir }}/proxies" state: directory -- name: Copy {{ certbot_hostname }} templated scripts - ansible.builtin.template: - src: "{{ item }}" - dest: /usr/local/bin/{{ item }} - mode: +x - loop: - - docker-certbot-renew - - docker-certbot-list - - name: Copy {{ role_name }} scripts ansible.builtin.copy: src: "{{ item }}" diff --git a/roles/certbot/tasks/certbot_renew.yml b/roles/certbot/tasks/certbot_renew.yml index b01c41af..56879a00 100644 --- a/roles/certbot/tasks/certbot_renew.yml +++ b/roles/certbot/tasks/certbot_renew.yml @@ -1,4 +1,13 @@ --- +- name: Copy {{ certbot_hostname }} templated scripts + ansible.builtin.template: + src: "{{ item }}" + dest: /usr/local/bin/{{ item }} + mode: +x + loop: + - docker-certbot-renew + - docker-certbot-list + - name: Register renew certs job ansible.builtin.cron: name: Renew certs for {{ nginx_hostname }} diff --git a/roles/clean/tasks/main.yml b/roles/clean/tasks/main.yml index 2e97d6c9..a4871db2 100644 --- a/roles/clean/tasks/main.yml +++ b/roles/clean/tasks/main.yml @@ -1,10 +1,10 @@ --- - name: Include cleanup tasks ansible.builtin.include_tasks: "{{ item }}.yml" - when: item in tasks + when: item in ansible_tags loop: "{{ ansible_run_tags }}" vars: - tasks: + ansible_tags: - certbot - nginx - modsecurity diff --git a/roles/debug/tasks/debug.yml b/roles/debug/tasks/debug.yml index 6ad4fd61..22a0bfb7 100644 --- a/roles/debug/tasks/debug.yml +++ b/roles/debug/tasks/debug.yml @@ -6,7 +6,7 @@ # - name: Collect bouncer keys # set_fact: -# bouncer_key_env: "{{ +# bouncer_key_env: "{{ # groups['all'] | map('extract', hostvars) | # json_query('[?crowdsec_firewall_bouncer_enabled && crowdsec_firewall_bouncer_enabled==`true`].{key: inventory_hostname, value: vault_crowdsec_firewall_bouncer_key}') | # list diff --git a/roles/odoo/tasks/odoo.yml b/roles/odoo/tasks/odoo.yml index ee06b20d..559b7b4f 100644 --- a/roles/odoo/tasks/odoo.yml +++ b/roles/odoo/tasks/odoo.yml @@ -73,6 +73,7 @@ LIST_DB: "{{ odoo_list_db }}" PROXY_MODE: "{{ odoo_proxy_mode }}" PIP_INSTALL: "{{ odoo_pip_install | default('') }}" + WORKERS: "{{ odoo_workers | int }}" ports: "{{ odoo_ports | default([]) }}" volumes: "{{ odoo_volumes }}" networks: diff --git a/roles/odoo_apps/tasks/odoo_apps.yml b/roles/odoo_apps/tasks/odoo_apps.yml index 0c1b1e7d..7c0c9ae8 100644 --- a/roles/odoo_apps/tasks/odoo_apps.yml +++ b/roles/odoo_apps/tasks/odoo_apps.yml @@ -44,8 +44,6 @@ dest: "{{ odoo_apps_tmp_dir }}" remote_src: true list_files: true - # args: - # creates: "{{ odoo_apps_tmp_dir }}/{{ item.name }}-{{ item.version }}" loop: "{{ downloaded_apps }}" when: item.changed