b222d26c86
As suggested in #65 (Github issue), this patch switches cronjob management from using templates to using Ansible's `cron` module. It also moves the management of the nginx-reload cronjob to `setup_ssl_lets_encrypt.yml`, which is a more fitting place for it (given that this cronjob is only required when Let's Encrypt is used). Pros: - using a module is more Ansible-ish than templating our own files in special directories - more reliable: will fail early (during playbook execution) if `/usr/bin/crontab` is not available, which is more of a guarantee that cron is working fine (idea: we should probably install some cron package using the playbook) Cons: - invocation schedule is no longer configurable, unless we define individual variables for everything or do something smart (splitting on ' ', etc.). Likely not necessary, however. - requires us to deprecate and clean-up after the old way of managing cronjobs, because it's not compatible (using the same file as before means appending additional jobs to it)
114 lines
3.9 KiB
YAML
114 lines
3.9 KiB
YAML
---
|
|
|
|
# This is a cleanup/migration task, because of to the new way we manage cronjobs (`cron` module) and the new script name.
|
|
# This migration task can be removed some time in the future.
|
|
- name: (Migration) Remove deprecated Let's Encrypt SSL certificate management files
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- /usr/local/bin/matrix-ssl-certificates-renew
|
|
- /etc/cron.d/matrix-ssl-certificate-renewal
|
|
- /etc/cron.d/matrix-nginx-proxy-periodic-restarter
|
|
|
|
|
|
#
|
|
# Tasks related to setting up Let's Encrypt's management of certificates
|
|
#
|
|
|
|
- name: (Deprecation) Fail if using outdated configuration
|
|
fail:
|
|
msg: "You're using the `host_specific_matrix_ssl_support_email` variable, which has been superseded by `host_specific_matrix_ssl_lets_encrypt_support_email`. Please change your configuration to use the new name!"
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt' and host_specific_matrix_ssl_support_email is defined"
|
|
|
|
- name: Allow access to HTTP/HTTPS in firewalld
|
|
firewalld:
|
|
service: "{{ item }}"
|
|
state: enabled
|
|
immediate: yes
|
|
permanent: yes
|
|
with_items:
|
|
- http
|
|
- https
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt' and ansible_os_family == 'RedHat'"
|
|
|
|
- name: Ensure certbot Docker image is pulled
|
|
docker_image:
|
|
name: "{{ matrix_ssl_lets_encrypt_certbot_docker_image }}"
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
- name: Obtain Let's Encrypt certificates
|
|
include_tasks: "{{ role_path }}/tasks/setup/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml"
|
|
with_items: "{{ domains_requiring_certificates }}"
|
|
loop_control:
|
|
loop_var: domain_name
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
- name: Ensure Let's Encrypt SSL renewal script installed
|
|
template:
|
|
src: "{{ role_path }}/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2"
|
|
dest: /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew
|
|
mode: 0750
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
- block:
|
|
- name: Ensure periodic SSL renewal cronjob configured (MAILTO)
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
env: yes
|
|
name: MAILTO
|
|
value: "{{ matrix_ssl_lets_encrypt_support_email }}"
|
|
|
|
- name: Ensure periodic SSL renewal cronjob configured (matrix-ssl-lets-encrypt-certificates-renew)
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
name: matrix-ssl-lets-encrypt-certificates-renew
|
|
state: present
|
|
hour: 4
|
|
minute: 15
|
|
day: "*/5"
|
|
job: /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew
|
|
|
|
- name: Ensure periodic reloading of matrix-nginx-proxy is configured for SSL renewal (matrix-nginx-proxy-reload)
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
name: matrix-nginx-proxy-reload
|
|
state: present
|
|
hour: 4
|
|
minute: 20
|
|
day: "*/5"
|
|
job: /usr/bin/systemctl reload matrix-nginx-proxy.service
|
|
when: matrix_nginx_proxy_enabled
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
|
|
#
|
|
# Tasks related to getting rid of Let's Encrypt's management of certificates
|
|
#
|
|
|
|
# When nginx-proxy is disabled, make sure its reloading cronjob is gone.
|
|
# Other cronjobs can potentially remain there (see below).
|
|
- name: Ensure matrix-nginx-proxy-reload cronjob removed
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
name: matrix-nginx-proxy-reload
|
|
state: absent
|
|
when: "not matrix_nginx_proxy_enabled"
|
|
|
|
# When Let's Encrypt is not used at all, remove all cronjobs in that cron file.
|
|
- name: Ensure matrix-ssl-lets-encrypt-renew cronjob removed
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
state: absent
|
|
when: "matrix_ssl_retrieval_method != 'lets-encrypt'"
|
|
|
|
- name: Ensure Let's Encrypt SSL renewal script removed
|
|
file:
|
|
path: /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew
|
|
state: absent
|
|
when: "matrix_ssl_retrieval_method != 'lets-encrypt'" |