finallycoffee/base
5
0
Fork 1
Code Issues 1 Pull Requests 3 Packages Projects Releases Wiki Activity

feat(lego): add auto-update mechanism

Browse Source
This commit is contained in:
transcaffeine 2025-04-07 16:45:40 +02:00
parent 877c5a137a
commit 3733c0b7ab
Signed by: transcaffeine
GPG Key ID: 03624C433676E465
1 changed files with 28 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
roles/lego/tasks/main.yml
View File

@ -25,35 +25,44 @@
- "{{ lego_cert_group }}" - "{{ lego_cert_group }}"
append: true append: true
- name: Ensure lego is installed - name: Check if lego is present
block: ansible.builtin.command:
- name: Check if lego is present cmd: which lego
ansible.builtin.command: changed_when: false
cmd: which lego failed_when: false
changed_when: false register: lego_binary_info
failed_when: false check_mode: false
register: lego_binary_info
- name: Check which version of lego is present
ansible.builtin.command:
cmd: "lego --version"
changed_when: false
failed_when: false
register: lego_binary_version_info
when: lego_binary_info.rc == 0
check_mode: false
- name: Ensure lego is installed
when: (lego_binary_info.rc != 0) or (lego_version not in lego_binary_version_info.stdout)
block:
- name: Download lego from source - name: Download lego from source
ansible.builtin.get_url: ansible.builtin.get_url:
url: "{{ lego_release_archive_url }}" url: "{{ lego_release_archive_url }}"
url_username: "{{ lego_release_archive_url_username | default(omit) }}" url_username: "{{ lego_release_archive_url_username | default(omit) }}"
url_password: "{{ lego_release_archive_url_password | default(omit) }}" url_password: "{{ lego_release_archive_url_password | default(omit) }}"
dest: "{{ lego_release_archive_file_path }}" dest: "{{ lego_release_archive_file_path }}"
when: lego_binary_info.rc != 0
- name: Create folder to uncompress into - name: Create folder to uncompress into
ansible.builtin.file: ansible.builtin.file:
dest: "{{ lego_release_archive_path }}" dest: "{{ lego_release_archive_path }}"
state: directory state: directory
when: lego_binary_info.rc != 0
- name: Uncompress lego source archive - name: Uncompress lego source archive
ansible.builtin.unarchive: ansible.builtin.unarchive:
src: "{{ lego_release_archive_file_path }}" src: "{{ lego_release_archive_file_path }}"
dest: "{{ lego_release_archive_path }}" dest: "{{ lego_release_archive_path }}"
remote_src: true remote_src: true
when: lego_binary_info.rc != 0 ignore_errors: "{{ ansible_check_mode }}"
- name: Ensure lego binary is present in PATH - name: Ensure lego binary is present in PATH
ansible.builtin.copy: ansible.builtin.copy:
@ -61,14 +70,7 @@
dest: "/usr/local/bin/lego" dest: "/usr/local/bin/lego"
mode: "u+rwx,g+rx,o+rx" mode: "u+rwx,g+rx,o+rx"
remote_src: true remote_src: true
when: lego_binary_info.rc != 0 ignore_errors: "{{ ansible_check_mode }}"
- name: Ensure lego is allowed to bind to ports < 1024
community.general.capabilities:
path: "/usr/local/bin/lego"
capability: "cap_net_bind_service+ep"
state: present
when: lego_binary_allow_net_bind_service
- name: Ensure intermediate data is gone - name: Ensure intermediate data is gone
ansible.builtin.file: ansible.builtin.file:
@ -77,7 +79,13 @@
loop: loop:
- "{{ lego_release_archive_path }}" - "{{ lego_release_archive_path }}"
- "{{ lego_release_archive_file_path }}" - "{{ lego_release_archive_file_path }}"
when: lego_binary_info.rc != 0
- name: Ensure lego is allowed to bind to ports < 1024
community.general.capabilities:
path: "/usr/local/bin/lego"
capability: "cap_net_bind_service+ep"
state: present
when: lego_binary_allow_net_bind_service
- name: Ensure lego base path exists - name: Ensure lego base path exists
ansible.builtin.file: ansible.builtin.file: