ansible-nginx/tasks/ssl/standard.yml

73 lines
2.1 KiB
YAML
Raw Normal View History

2016-01-12 00:20:42 +07:00
---
2019-02-13 00:04:57 +07:00
- block:
2020-02-04 19:08:48 +07:00
- name: STAT | Get info about DH file
2019-02-13 00:04:57 +07:00
stat:
path: "{{ nginx_dh_path }}"
get_checksum: no
register: stat_dh_file
- name: SHELL | Get info about DH file
shell: openssl dhparam -in {{ nginx_dh_path }} -text -noout 2>&1 | awk '/DH Parameters/ { print substr($3, 2) }'
changed_when: false
register: dh_info
when: stat_dh_file.stat.exists
- name: COMMAND | Generate DH file
command: openssl dhparam -out {{ nginx_dh_path }} {{ nginx_dh_length }}
when: not stat_dh_file.stat.exists or (dh_info.stdout | int != nginx_dh_length | int)
notify: restart nginx
2016-01-12 17:16:41 +07:00
when: nginx_dh is not string
- name: COPY | Deploy DH file from vars
2017-07-27 17:21:10 +07:00
copy:
content: "{{ nginx_dh }}"
dest: "{{ nginx_dh_path }}"
2016-01-12 17:16:41 +07:00
when: nginx_dh is string
2017-11-03 16:30:24 +07:00
notify: restart nginx
2016-01-12 00:20:42 +07:00
- name: FILE | Create SSL directories
2017-07-27 17:21:10 +07:00
file:
path: "{{ item | nginx_ssl_dir(nginx_ssl_dir) }}"
2017-07-27 17:21:10 +07:00
state: directory
2019-02-05 03:25:25 +07:00
loop: "{{ nginx_ssl_pairs }}"
2016-01-12 23:26:30 +07:00
when: item.dest_key is not defined or item.dest_cert is not defined
2018-03-15 22:10:37 +07:00
no_log: not nginx_debug_role
2016-01-12 00:20:42 +07:00
- name: COPY | Deploy SSL keys
2017-07-27 17:21:10 +07:00
copy:
content: "{{ item.key }}"
dest: "{{ item | nginx_key_path(nginx_ssl_dir) }}"
2017-07-27 17:21:10 +07:00
mode: 0640
2019-02-05 03:25:25 +07:00
loop: "{{ nginx_ssl_pairs }}"
2016-01-12 23:26:30 +07:00
when: item.key is defined
2017-11-03 16:30:24 +07:00
notify: restart nginx
2018-03-15 22:10:37 +07:00
no_log: not nginx_debug_role
2016-01-12 00:20:42 +07:00
- name: COPY | Deploy SSL certs
2017-07-27 17:21:10 +07:00
copy:
content: "{{ item.cert }}"
dest: "{{ item | nginx_cert_path(nginx_ssl_dir) }}"
2017-07-27 17:21:10 +07:00
mode: 0644
2019-02-05 03:25:25 +07:00
loop: "{{ nginx_ssl_pairs }}"
2016-01-12 23:26:30 +07:00
when: item.cert is defined
2017-11-03 16:30:24 +07:00
notify: restart nginx
2018-03-15 22:10:37 +07:00
no_log: not nginx_debug_role
2016-01-12 00:20:42 +07:00
2018-04-20 14:32:46 +07:00
- name: COMMAND | Create self-signed certificates
command: |
openssl req
-new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509
-subj '/CN={{ item | nginx_site_name }}'
-keyout {{ item | nginx_key_path(nginx_ssl_dir) }}
-out {{ item | nginx_cert_path(nginx_ssl_dir) }}
2018-04-20 14:32:46 +07:00
args:
chdir: "{{ item | nginx_ssl_dir(nginx_ssl_dir) }}"
creates: "{{ '/tmp/dummy' if item.force is defined and item.force else item | nginx_cert_path(nginx_ssl_dir) }}"
2019-02-05 03:25:25 +07:00
loop: "{{ nginx_ssl_pairs }}"
2018-04-20 14:32:46 +07:00
when: item.self_signed is defined
notify: restart nginx
no_log: not nginx_debug_role