eletrotupi / tcc/ ansible/roles/nginx/tasks/main.yml1f2f0a154b75b7aab487b802e714150fc0eab4f5
2.8 KB | 101 lines Raw
1
---
2
# roles/nginx/tasks/main.yml
3
# Publishes the vhost, two-phase around the ACME certificate
4
#
5
#   deploy.yml (this role) will HTTP-only block, then obtain cert via the wrapper then
6
#   HTTPS block. The certificate itself is managed by the `uacme` role; if the
7
#   account is not registered yet, this role leaves the HTTP block in place and
8
#   tells you the one manual command to run
9
10
- name: Install nginx
11
  community.general.apk:
12
    name: nginx
13
    state: present
14
    update_cache: true
15
  tags: [packages, nginx]
16
17
- name: Remove the default nginx server block
18
  ansible.builtin.file:
19
    path: "{{ nginx_conf_dir }}/default.conf"
20
    state: absent
21
  notify: reload nginx
22
  tags: [nginx]
23
24
- name: Ensure the ACME webroot exists
25
  ansible.builtin.file:
26
    path: "{{ nginx_well_known_root }}/.well-known"
27
    state: directory
28
    owner: root
29
    group: root
30
    mode: "0755"
31
  tags: [nginx]
32
33
- name: Ensure /srv/static exists for the thesis PDF
34
  ansible.builtin.file:
35
    path: "{{ nginx_static_root }}"
36
    state: directory
37
    owner: "{{ deploy_user }}"
38
    group: nginx
39
    mode: "0750"
40
  tags: [nginx]
41
42
- name: Ensure nginx is enabled and running
43
  ansible.builtin.service:
44
    name: nginx
45
    enabled: true
46
    state: started
47
  tags: [nginx]
48
49
- name: Check whether the certificate exists
50
  ansible.builtin.stat:
51
    path: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
52
  register: nginx_cert
53
  tags: [nginx]
54
55
- name: Deploy the HTTP-only server block
56
  ansible.builtin.template:
57
    src: site.http.j2
58
    dest: "{{ nginx_conf_dir }}/{{ vhosts[0] }}.conf"
59
    mode: "0644"
60
  notify: reload nginx
61
  when: not nginx_cert.stat.exists
62
  tags: [nginx]
63
64
- name: Flush handlers so the HTTP block is live before requesting a certificate
65
  ansible.builtin.meta: flush_handlers
66
  tags: [nginx]
67
68
- name: Obtain the certificate via the acme wrapper
69
  ansible.builtin.command:
70
    cmd: "{{ nginx_acme_wrapper }} {{ vhosts[0] }}"
71
    creates: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
72
  when: not nginx_cert.stat.exists
73
  register: nginx_acme
74
  changed_when: nginx_acme.rc == 0
75
  failed_when: false
76
  tags: [nginx]
77
78
- name: Re-check whether the certificate now exists
79
  ansible.builtin.stat:
80
    path: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
81
  register: nginx_cert_after
82
  tags: [nginx]
83
84
- name: Deploy the HTTPS server block
85
  ansible.builtin.template:
86
    src: site.https.j2
87
    dest: "{{ nginx_conf_dir }}/{{ vhosts[0] }}.conf"
88
    mode: "0644"
89
  notify: reload nginx
90
  when: nginx_cert_after.stat.exists
91
  tags: [nginx]
92
93
- name: Explain the manual step when no certificate is available yet
94
  ansible.builtin.debug:
95
    msg: |-
96
      No TLS certificate for {{ vhosts[0] }} yet. If uacme is not registered,
97
      run this once by hand and then re-run deploy.yml:
98
99
        doas -u acme uacme -v -h /usr/share/uacme/uacme.sh new {{ vhosts[0] }}
100
  when: not nginx_cert_after.stat.exists
101
  tags: [nginx]