Use fully-qualified module names for builtin Ansible modules
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1939
This commit is contained in:
@ -1,12 +1,12 @@
|
||||
---
|
||||
|
||||
- name: Fail if using unsupported SSL certificate retrieval method
|
||||
fail:
|
||||
ansible.builtin.fail:
|
||||
msg: "The `matrix_ssl_retrieval_method` variable contains an unsupported value"
|
||||
when: "matrix_ssl_retrieval_method not in ['lets-encrypt', 'self-signed', 'manually-managed', 'none']"
|
||||
|
||||
- name: Fail if using unsupported private key type
|
||||
fail:
|
||||
ansible.builtin.fail:
|
||||
msg: "The `matrix_ssl_lets_encrypt_key_type` variable contains an unsupported value"
|
||||
when: "matrix_ssl_lets_encrypt_key_type not in ['rsa', 'ecdsa']"
|
||||
|
||||
@ -14,7 +14,7 @@
|
||||
# Common tasks, required by almost any method below.
|
||||
|
||||
- name: Ensure SSL certificate paths exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: 0770
|
||||
|
@ -3,7 +3,7 @@
|
||||
# This is a cleanup/migration task, because of to the new way we manage cronjobs (`cron` module) and the new script name.
|
||||
# This migration task can be removed some time in the future.
|
||||
- name: (Migration) Remove deprecated Let's Encrypt SSL certificate management files
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
@ -31,13 +31,13 @@
|
||||
loop_var: domain_name
|
||||
|
||||
- name: Ensure Let's Encrypt SSL renewal script installed
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2"
|
||||
dest: "{{ matrix_local_bin_path }}/matrix-ssl-lets-encrypt-certificates-renew"
|
||||
mode: 0755
|
||||
|
||||
- name: Ensure SSL renewal systemd units installed
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/systemd/{{ item.name }}.j2"
|
||||
dest: "{{ matrix_systemd_path }}/{{ item.name }}"
|
||||
mode: 0644
|
||||
@ -51,14 +51,14 @@
|
||||
|
||||
- block:
|
||||
- name: Ensure matrix-ssl-lets-encrypt-renew cronjob removed
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_systemd_path }}/{{ item.name }}"
|
||||
state: absent
|
||||
when: "not item.applicable|bool"
|
||||
with_items: "{{ matrix_ssl_renewal_systemd_units_list }}"
|
||||
|
||||
- name: Ensure Let's Encrypt SSL renewal script removed
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_local_bin_path }}/matrix-ssl-lets-encrypt-certificates-renew"
|
||||
state: absent
|
||||
when: "matrix_ssl_retrieval_method != 'lets-encrypt'"
|
||||
|
@ -1,8 +1,8 @@
|
||||
---
|
||||
- debug:
|
||||
- ansible.builtin.debug:
|
||||
msg: "Dealing with SSL certificate retrieval for domain: {{ domain_name }}"
|
||||
|
||||
- set_fact:
|
||||
- ansible.builtin.set_fact:
|
||||
domain_name_certificate_path: "{{ matrix_ssl_config_dir_path }}/live/{{ domain_name }}/fullchain.pem"
|
||||
|
||||
- name: Check if a certificate for the domain already exists
|
||||
@ -10,12 +10,12 @@
|
||||
path: "{{ domain_name_certificate_path }}"
|
||||
register: domain_name_certificate_path_stat
|
||||
|
||||
- set_fact:
|
||||
- ansible.builtin.set_fact:
|
||||
domain_name_needs_cert: "{{ not domain_name_certificate_path_stat.stat.exists }}"
|
||||
|
||||
- block:
|
||||
- name: Ensure required service for obtaining is started
|
||||
service:
|
||||
ansible.builtin.service:
|
||||
name: "{{ matrix_ssl_pre_obtaining_required_service_name }}"
|
||||
state: started
|
||||
register: matrix_ssl_pre_obtaining_required_service_start_result
|
||||
@ -29,7 +29,7 @@
|
||||
# This will fail if there is something running on port 80 (like matrix-nginx-proxy).
|
||||
# We suppress the error, as we'll try another method below.
|
||||
- name: Attempt initial SSL certificate retrieval with standalone authenticator (directly)
|
||||
shell: >-
|
||||
ansible.builtin.shell: >-
|
||||
{{ matrix_host_command_docker }} run
|
||||
--rm
|
||||
--name=matrix-certbot
|
||||
@ -58,7 +58,7 @@
|
||||
# If matrix-nginx-proxy is configured from a previous run of this playbook,
|
||||
# and it's running now, it may be able to proxy requests to `matrix_ssl_lets_encrypt_certbot_standalone_http_port`.
|
||||
- name: Attempt initial SSL certificate retrieval with standalone authenticator (via proxy)
|
||||
shell: >-
|
||||
ansible.builtin.shell: >-
|
||||
{{ matrix_host_command_docker }} run
|
||||
--rm
|
||||
--name=matrix-certbot
|
||||
@ -86,7 +86,7 @@
|
||||
ignore_errors: true
|
||||
|
||||
- name: Fail if all SSL certificate retrieval attempts failed
|
||||
fail:
|
||||
ansible.builtin.fail:
|
||||
msg: |
|
||||
Failed to obtain a certificate directly (by listening on port 80)
|
||||
and also failed to obtain by relying on the server at port 80 to proxy the request.
|
||||
|
@ -1,6 +1,6 @@
|
||||
---
|
||||
|
||||
- set_fact:
|
||||
- ansible.builtin.set_fact:
|
||||
matrix_ssl_certificate_verification_cert_path: "{{ matrix_ssl_config_dir_path }}/live/{{ domain_name }}/fullchain.pem"
|
||||
matrix_ssl_certificate_verification_cert_key_path: "{{ matrix_ssl_config_dir_path }}/live/{{ domain_name }}/privkey.pem"
|
||||
|
||||
@ -9,7 +9,7 @@
|
||||
path: "{{ matrix_ssl_certificate_verification_cert_path }}"
|
||||
register: matrix_ssl_certificate_verification_cert_path_stat_result
|
||||
|
||||
- fail:
|
||||
- ansible.builtin.fail:
|
||||
msg: "Failed finding a certificate file (for domain `{{ domain_name }}`) at `{{ matrix_ssl_certificate_verification_cert_path }}`"
|
||||
when: "not matrix_ssl_certificate_verification_cert_path_stat_result.stat.exists"
|
||||
|
||||
@ -18,6 +18,6 @@
|
||||
path: "{{ matrix_ssl_certificate_verification_cert_key_path }}"
|
||||
register: matrix_ssl_certificate_verification_cert_key_path_stat_result
|
||||
|
||||
- fail:
|
||||
- ansible.builtin.fail:
|
||||
msg: "Failed finding a certificate key file (for domain `{{ domain_name }}`) at `{{ matrix_ssl_certificate_verification_cert_key_path }}`"
|
||||
when: "not matrix_ssl_certificate_verification_cert_key_path_stat_result.stat.exists"
|
||||
|
@ -1,6 +1,6 @@
|
||||
---
|
||||
|
||||
- set_fact:
|
||||
- ansible.builtin.set_fact:
|
||||
matrix_ssl_certificate_csr_path: "{{ matrix_ssl_config_dir_path }}/live/{{ domain_name }}/csr.csr"
|
||||
matrix_ssl_certificate_cert_path: "{{ matrix_ssl_config_dir_path }}/live/{{ domain_name }}/fullchain.pem"
|
||||
matrix_ssl_certificate_cert_key_path: "{{ matrix_ssl_config_dir_path }}/live/{{ domain_name }}/privkey.pem"
|
||||
@ -12,7 +12,7 @@
|
||||
|
||||
# In order to do any sort of generation (below), we need to ensure the directory exists first
|
||||
- name: Ensure SSL certificate directory exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_ssl_certificate_csr_path|dirname }}"
|
||||
state: directory
|
||||
mode: 0750
|
||||
@ -28,7 +28,7 @@
|
||||
#
|
||||
# We'll do it in a more manual way.
|
||||
- name: Generate SSL certificate
|
||||
command: |
|
||||
ansible.builtin.command: |
|
||||
openssl req -x509 \
|
||||
-sha256 \
|
||||
-newkey rsa:4096 \
|
||||
@ -40,7 +40,7 @@
|
||||
when: "not matrix_ssl_certificate_cert_path_stat_result.stat.exists"
|
||||
|
||||
- name: Adjust SSL certificate file ownership
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_groupname }}"
|
||||
|
Reference in New Issue
Block a user