finallycoffee/base
5
0
Fork 1
Code Issues 1 Pull Requests 3 Packages Projects Releases Wiki Activity

Add cap_net_bind capabilities to systemd unit and ensure correct permissions #8

Manually merged
jadyn merged 2 commits from jadyn/finallycoffee.base:main into main 2024-09-12 06:01:58 +00:00
Conversation 0 Commits 2 Files Changed 3 +7 -1
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
roles/lego/defaults/main.yml
View File

@ -5,6 +5,7 @@ lego_instance: default
lego_base_path: "/opt/lego" lego_base_path: "/opt/lego"
lego_cert_user: "acme-{{ lego_instance }}" lego_cert_user: "acme-{{ lego_instance }}"
lego_cert_group: "{{ lego_cert_user }}" lego_cert_group: "{{ lego_cert_user }}"
lego_cert_mode: "0640" # rw-r-----
lego_systemd_user: "acme-%i" lego_systemd_user: "acme-%i"
lego_systemd_group: "{{ lego_systemd_user }}" lego_systemd_group: "{{ lego_systemd_user }}"
lego_instance_base_path: "{{ lego_base_path }}/instances" lego_instance_base_path: "{{ lego_base_path }}/instances"
@ -24,6 +25,7 @@ lego_acme_server_url: "{{ lego_letsencrypt_server_urls.qa }}"
lego_base_environment: lego_base_environment:
LEGO_CERT_USER: "{{ lego_cert_user }}" LEGO_CERT_USER: "{{ lego_cert_user }}"
LEGO_CERT_GROUP: "{{ lego_cert_group }}" LEGO_CERT_GROUP: "{{ lego_cert_group }}"
LEGO_CERT_MODE: "{{ lego_cert_mode }}"
LEGO_CERT_STORE_PATH: "{{ lego_instance_path }}" LEGO_CERT_STORE_PATH: "{{ lego_instance_path }}"
LEGO_CERT_DAYS_TO_RENEW: "{{ lego_cert_days_to_renew }}" LEGO_CERT_DAYS_TO_RENEW: "{{ lego_cert_days_to_renew }}"
LEGO_KEY_TYPE: "{{ lego_cert_key_type }}" LEGO_KEY_TYPE: "{{ lego_cert_key_type }}"

5
roles/lego/files/lego_run.sh
View File

@ -16,4 +16,7 @@ if [[ $FILES_IN_DIR -gt 2 ]]; then
$LEGO_BINARY $LEGO_COMMAND_ARGS_EXPANDED renew --days=$LEGO_CERT_DAYS_TO_RENEW $LEGO_BINARY $LEGO_COMMAND_ARGS_EXPANDED renew --days=$LEGO_CERT_DAYS_TO_RENEW
else else
$LEGO_BINARY $LEGO_COMMAND_ARGS_EXPANDED run $LEGO_BINARY $LEGO_COMMAND_ARGS_EXPANDED run
fi fi
ls "$LEGO_CERT_STORE_PATH/certificates" | xargs -I{} -n 1 chmod "$LEGO_CERT_MODE" "$LEGO_CERT_STORE_PATH/certificates/{}"
ls "$LEGO_CERT_STORE_PATH/certificates" | xargs -I{} -n 1 chown "$LEGO_CERT_USER":"$LEGO_CERT_GROUP" "$LEGO_CERT_STORE_PATH/certificates/{}"

1
roles/lego/templates/lego@.service.j2
View File

@ -7,6 +7,7 @@ EnvironmentFile={{ lego_base_path }}/%i.conf
User={{ lego_systemd_user }} User={{ lego_systemd_user }}
Group={{ lego_systemd_group }} Group={{ lego_systemd_group }}
ExecStart={{ lego_base_path }}/run.sh ExecStart={{ lego_base_path }}/run.sh
AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install] [Install]
WantedBy=basic.target WantedBy=basic.target