ansible/roles/nextcloud/tasks/main.yml

92 lines
3.3 KiB
YAML
Raw Normal View History

2020-02-05 20:23:20 -06:00
#!/usr/bin/ansible-playbook
# vim:ft=ansible:
---
- name: Install, configure, and start Nextcloud
block:
- name: Install Nextcloud-required packages
apt:
name: "{{ packages }}"
vars:
packages:
- apache2
- mariadb-server
- libapache2-mod-php
- php7.2
- php7.2-xml
- php7.2-curl
- php7.2-gd
- php7.2-cgi
- php7.2-cli
- php7.2-zip
- php7.2-mysql
- php7.2-mbstring
- python-openssl # Needed for keygen
- python3-openssl
- name: Copy configuration
2020-02-05 21:26:03 -06:00
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "{{ item.mode }}"
loop:
- { src: "php-apache2.ini", dest: "/etc/php/7.2/apache2/php.ini", mode: "0644" }
- { src: "php-cgi.ini", dest: "/etc/php/7.2/cgi/php.ini", mode: "0644" }
2020-02-05 20:23:20 -06:00
- name: Register certificates
block:
- name: Set up our filesystem heirarchy
file:
path: "{{ item.dir }}"
mode: "{{ item.mode }}"
recurse: yes
state: directory
loop:
- { dir: "/etc/pki", mode: "0600" }
- { dir: "/etc/pki/cert", mode: "0600" }
2020-02-05 21:06:44 -06:00
- { dir: "/etc/pki/cert/crt", mode: "0600" }
2020-02-05 20:23:20 -06:00
- { dir: "/etc/pki/cert/csr", mode: "0600" }
- { dir: "/etc/pki/cert/private", mode: "0600" }
- { dir: "/etc/pki/cert/challenge/{{ website_url }}", mode: "0600" }
- name: Create ACME account key
openssl_privatekey:
path: "/etc/pki/cert/private/account.key"
size: 4096
2020-02-05 21:06:44 -06:00
- name: Create certificate key
openssl_privatekey:
path: "/etc/pki/cert/private/{{ website_url }}.key"
size: 4096
2020-02-05 20:23:20 -06:00
- name: Create CSR
openssl_csr:
path: "/etc/pki/cert/csr/{{ website_url }}.csr"
common_name: "{{ website_url }}"
privatekey_path: /etc/pki/cert/private/account.key
email_address: "rehashedsalt@cock.li"
- name: Create well-known directory
file:
mode: "0644"
2020-02-05 21:26:03 -06:00
path: "{{ website_root }}/.well-known/acme-challenge"
state: directory
2020-02-05 21:06:44 -06:00
- name: Create challenge for CSR
2020-02-05 20:23:20 -06:00
acme_certificate:
acme_directory: "https://acme-staging-v02.api.letsencrypt.org/directory"
acme_version: 2
terms_agreed: yes
account_email: "rehashedsalt@cock.li"
2020-02-05 21:06:44 -06:00
account_key: "/etc/pki/cert/private/account.key"
csr: "/etc/pki/cert/csr/{{ website_url }}.csr"
dest: "/etc/pki/cert/crt/{{ website_url }}.crt"
fullchain_dest: "/etc/pki/cert/crt/{{ website_url }}-fullchain.crt"
register: com_challenge
- name: Fulfill challenge
copy:
2020-02-05 21:26:03 -06:00
dest: "{{ website_root }}/{{ com_challenge['challenge_data'][website_url]['http-01']['resource'] }}"
2020-02-05 21:06:44 -06:00
content: "{{ com_challenge['challenge_data'][website_url]['http-01']['resource_value'] }}"
when: com_challenge is changed
- name: Create certificate
acme_certificate:
2020-02-05 20:23:20 -06:00
account_key: /etc/pki/cert/private/account.key
csr: "/etc/pki/cert/csr/{{ website_url }}.csr"
2020-02-05 21:06:44 -06:00
dest: "/etc/pki/cert/crt/{{ website_url }}.crt"
fullchain_dest: "/etc/pki/cert/crt/{{ website_url }}-fullchain.crt"
chain_dest: "/etc/pki/cert/crt/{{ website_url }}-intermediate.crt"
data: "{{ com_challenge }}"
become: yes