Now installs a LE SSL cert via certbot by default
All checks were successful
Ansible Lint |Total|New|Outstanding|Fixed|Trend
|:-:|:-:|:-:|:-:|:-:
|4806|28|4778|15|:-1:
Reference build: <a href="https://jenkins.evolix.org/job/gitea/job/ansible-roles/job/privatebin/1//ansiblelint">Evolix » ansible-roles » privatebin #1</a>
gitea/ansible-roles/pipeline/head This commit looks good
All checks were successful
Ansible Lint |Total|New|Outstanding|Fixed|Trend
|:-:|:-:|:-:|:-:|:-:
|4806|28|4778|15|:-1:
Reference build: <a href="https://jenkins.evolix.org/job/gitea/job/ansible-roles/job/privatebin/1//ansiblelint">Evolix » ansible-roles » privatebin #1</a>
gitea/ansible-roles/pipeline/head This commit looks good
This commit is contained in:
parent
8634c92ef8
commit
ac9b21eb60
|
@ -1,6 +1,7 @@
|
||||||
---
|
---
|
||||||
# defaults file for vars
|
# defaults file for vars
|
||||||
system_dep: "['apt-transport-https', 'git', 'certbot', 'libapache2-mod-php', 'libapache2-mpm-itk', 'php-gd']"
|
system_dep: "['apt-transport-https', 'git', 'certbot', 'acl', 'apache2', 'libapache2-mpm-itk', 'libapache2-mod-php', 'php-gd']"
|
||||||
git_url: 'https://github.com/PrivateBin/PrivateBin'
|
git_url: 'https://github.com/PrivateBin/PrivateBin'
|
||||||
git_version: '1.5.1'
|
git_version: '1.5.1'
|
||||||
domains: ['example.domain.org']
|
domains: ['example.domain.org']
|
||||||
|
certbot_admin_email: 'mgauthier@evolix.ca'
|
||||||
|
|
|
@ -4,6 +4,7 @@
|
||||||
- name: Install main system dependencies
|
- name: Install main system dependencies
|
||||||
apt:
|
apt:
|
||||||
name: "{{ system_dep }}"
|
name: "{{ system_dep }}"
|
||||||
|
update_cache: yes
|
||||||
|
|
||||||
- name: Add UNIX account
|
- name: Add UNIX account
|
||||||
user:
|
user:
|
||||||
|
@ -20,6 +21,20 @@
|
||||||
umask: '0022'
|
umask: '0022'
|
||||||
become_user: "{{ service }}"
|
become_user: "{{ service }}"
|
||||||
|
|
||||||
|
#- name: Create the conf-available dir if needed
|
||||||
|
# file:
|
||||||
|
# path: /etc/apache2/conf-available
|
||||||
|
# state: directory
|
||||||
|
# mode: '0750'
|
||||||
|
|
||||||
|
- name: Template apache conf for Let's Encrypt/Certbot
|
||||||
|
template:
|
||||||
|
src: "letsencrypt.conf.j2"
|
||||||
|
dest: "/etc/apache2/conf-available/letsencrypt.conf"
|
||||||
|
|
||||||
|
- name: Enable apache conf for Let's Encrypt/Certbot
|
||||||
|
command: "/usr/sbin/a2enconf letsencrypt.conf"
|
||||||
|
|
||||||
- name: Check if SSL certificate is present and register result
|
- name: Check if SSL certificate is present and register result
|
||||||
stat:
|
stat:
|
||||||
path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
||||||
|
@ -43,8 +58,17 @@
|
||||||
state: directory
|
state: directory
|
||||||
mode: '0755'
|
mode: '0755'
|
||||||
- name: Generate certificate with certbot
|
- name: Generate certificate with certbot
|
||||||
shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt -d {{ domains |first }}
|
shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
|
||||||
when: ssl.stat.exists == true
|
- name: Create the ssl dir if needed
|
||||||
|
file:
|
||||||
|
path: /etc/apache2/ssl
|
||||||
|
state: directory
|
||||||
|
mode: '0750'
|
||||||
|
- name: Template ssl block for apache vhost
|
||||||
|
template:
|
||||||
|
src: "ssl.conf.j2"
|
||||||
|
dest: "/etc/apache2/ssl/{{ service }}.conf"
|
||||||
|
when: ssl.stat.exists != true
|
||||||
|
|
||||||
- name: (Re)check if SSL certificate is present and register result
|
- name: (Re)check if SSL certificate is present and register result
|
||||||
stat:
|
stat:
|
||||||
|
@ -57,7 +81,7 @@
|
||||||
dest: "/etc/apache2/sites-available/{{ service }}.conf"
|
dest: "/etc/apache2/sites-available/{{ service }}.conf"
|
||||||
|
|
||||||
- name: Enable apache mode_rewrite
|
- name: Enable apache mode_rewrite
|
||||||
command: "/usr/sbin/a2enmod rewrite"
|
command: "/usr/sbin/a2enmod ssl rewrite"
|
||||||
|
|
||||||
- name: Enable .htaccess configuration
|
- name: Enable .htaccess configuration
|
||||||
copy:
|
copy:
|
||||||
|
|
11
webapps/privatebin/templates/letsencrypt.conf.j2
Normal file
11
webapps/privatebin/templates/letsencrypt.conf.j2
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
<IfModule jk_module>
|
||||||
|
SetEnvIf Request_URI "/.well-known/acme-challenge/*" no-jk
|
||||||
|
</IfModule>
|
||||||
|
<IfModule proxy_module>
|
||||||
|
ProxyPass /.well-known/acme-challenge/ !
|
||||||
|
</IfModule>
|
||||||
|
Alias /.well-known/acme-challenge /var/lib/letsencrypt/.well-known/acme-challenge
|
||||||
|
<Directory "/var/lib/letsencrypt/.well-known/acme-challenge">
|
||||||
|
Options -Indexes
|
||||||
|
Require all granted
|
||||||
|
</Directory>
|
3
webapps/privatebin/templates/ssl.conf.j2
Normal file
3
webapps/privatebin/templates/ssl.conf.j2
Normal file
|
@ -0,0 +1,3 @@
|
||||||
|
SSLEngine On
|
||||||
|
SSLCertificateFile /etc/letsencrypt/live/{{ domains |first }}/fullchain.pem
|
||||||
|
SSLCertificateKeyFile /etc/letsencrypt/live/{{ domains |first }}/privkey.pem
|
|
@ -1,7 +1,7 @@
|
||||||
<VirtualHost *:80>
|
<VirtualHost *:80>
|
||||||
ServerName {{ domains |first }}
|
ServerName {{ domains |first }}
|
||||||
|
|
||||||
{% if not ssl.stat.exists %}
|
{% if ssl.stat.exists %}
|
||||||
RewriteEngine On
|
RewriteEngine On
|
||||||
RewriteCond %{HTTPS} !=on
|
RewriteCond %{HTTPS} !=on
|
||||||
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
|
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
|
||||||
|
@ -10,7 +10,7 @@
|
||||||
|
|
||||||
</VirtualHost>
|
</VirtualHost>
|
||||||
|
|
||||||
{% if not ssl.stat.exists %}
|
{% if ssl.stat.exists %}
|
||||||
<VirtualHost *:443>
|
<VirtualHost *:443>
|
||||||
ServerName {{ domains |first }}
|
ServerName {{ domains |first }}
|
||||||
|
|
||||||
|
@ -24,16 +24,7 @@
|
||||||
|
|
||||||
AssignUserID {{ service }} {{ service }}
|
AssignUserID {{ service }} {{ service }}
|
||||||
|
|
||||||
SSLEngine On
|
IncludeOptional /etc/apache2/ssl/{{ service }}.conf
|
||||||
#SSLCertificateFile /etc/letsencrypt/live/{{ domains |first }}/fullchain.pem
|
|
||||||
#SSLCertificateKeyFile /etc/letsencrypt/live/{{ domains |first }}/privkey.pem
|
|
||||||
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
|
|
||||||
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
|
|
||||||
|
|
||||||
RewriteEngine On
|
|
||||||
RewriteCond %{HTTPS} !=on
|
|
||||||
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
|
|
||||||
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R=permanent]
|
|
||||||
|
|
||||||
</VirtualHost>
|
</VirtualHost>
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
Loading…
Reference in a new issue