128 lines
4.1 KiB
YAML
128 lines
4.1 KiB
YAML
---
|
|
- name: Génération du certificat SSL Let's Encrypt
|
|
hosts: infra
|
|
become: true
|
|
gather_facts: false
|
|
|
|
tasks:
|
|
- name: Installer certbot et le plugin nginx
|
|
ansible.builtin.apt:
|
|
name:
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- nginx
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Déployer la config Nginx HTTP simple (ACME challenge)
|
|
ansible.builtin.copy:
|
|
dest: /etc/nginx/sites-available/certbot
|
|
content: |
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name {{ domain_name }} {{ subdomains | join(' ') }};
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/html;
|
|
}
|
|
|
|
location / {
|
|
return 200 'ok';
|
|
add_header Content-Type text/plain;
|
|
}
|
|
}
|
|
|
|
- name: Activer le site certbot
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/certbot
|
|
dest: /etc/nginx/sites-enabled/certbot
|
|
state: link
|
|
force: yes
|
|
|
|
- name: Désactiver le site par défaut
|
|
ansible.builtin.file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
|
|
- name: Tester la configuration Nginx
|
|
ansible.builtin.command: nginx -t
|
|
changed_when: false
|
|
|
|
- name: Redémarrer Nginx
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: restarted
|
|
enabled: yes
|
|
|
|
- name: Ouvrir les ports dans UFW
|
|
ansible.builtin.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "22"
|
|
- "80"
|
|
- "443"
|
|
|
|
- name: Vérifier si le certificat existe déjà
|
|
ansible.builtin.stat:
|
|
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
register: cert_file
|
|
tags: [gen]
|
|
|
|
- name: Générer le certificat avec Certbot (domaine + sous-domaines)
|
|
ansible.builtin.command: >
|
|
certbot certonly --nginx
|
|
-d {{ domain_name }}
|
|
{{ subdomains | map('regex_replace', '^(.*)$', '-d \1') | join(' ') }}
|
|
--non-interactive
|
|
--agree-tos
|
|
--email admin@{{ domain_name }}
|
|
when: not cert_file.stat.exists
|
|
tags: [gen]
|
|
|
|
- name: Vérifier que le certificat a bien été généré
|
|
ansible.builtin.stat:
|
|
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
register: cert_check
|
|
|
|
- name: Afficher le résultat
|
|
ansible.builtin.debug:
|
|
msg: "{{ 'Certificat généré : /etc/letsencrypt/live/' + domain_name + '/fullchain.pem' if cert_check.stat.exists else 'ERREUR : certificat non trouvé' }}"
|
|
|
|
- name: Vérifier le renouvellement automatique
|
|
ansible.builtin.command: certbot renew --dry-run
|
|
changed_when: false
|
|
failed_when: false
|
|
when: cert_check.stat.exists
|
|
|
|
- name: Créer le dossier docker/certs
|
|
ansible.builtin.file:
|
|
path: "{{ docker_dir }}/nginx/certs"
|
|
state: directory
|
|
owner: "{{ docker_user }}"
|
|
group: "{{ docker_group }}"
|
|
mode: "0750"
|
|
tags: [create]
|
|
|
|
- name: Copier fullchain.pem dans docker/certs
|
|
ansible.builtin.copy:
|
|
src: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
dest: "{{ docker_dir }}/nginx/certs/fullchain.pem"
|
|
owner: "{{ docker_user }}"
|
|
group: "{{ docker_group }}"
|
|
mode: "0644"
|
|
remote_src: yes
|
|
tags: [create]
|
|
|
|
- name: Copier privkey.pem dans docker/certs
|
|
ansible.builtin.copy:
|
|
src: "/etc/letsencrypt/live/{{ domain_name }}/privkey.pem"
|
|
dest: "{{ docker_dir }}/nginx/certs/privkey.pem"
|
|
owner: "{{ docker_user }}"
|
|
group: "{{ docker_group }}"
|
|
mode: "0640"
|
|
remote_src: yes
|
|
tags: [create]
|