Add self-signed cert feature
parent
678dff9a1a
commit
817929beca
36
doc/ssl.md
36
doc/ssl.md
|
@ -15,25 +15,42 @@ Variables
|
|||
Cert/Key pairs
|
||||
--------------
|
||||
|
||||
This list have 3 mandatory keys:
|
||||
Each pair must have a `name`.
|
||||
Note: `name` is used to deploy key/cert. With defaults values dans `name` = "foo", key is -> /etc/nginx/ssl/foo/foo.key
|
||||
|
||||
- `name`: MUST be unique
|
||||
### Content mode
|
||||
|
||||
Key/Cert content is stored in variable. Usefull with vault.
|
||||
|
||||
- `key`: content of the private key
|
||||
- `cert`: content of the public key
|
||||
|
||||
OR
|
||||
### Remote file
|
||||
|
||||
You can use these variables if you use another task/role to manages your certificates.
|
||||
|
||||
- `dest_cert`: remote path where certificate is located
|
||||
- `dest_key`: remote path where key is located
|
||||
|
||||
Note: `name` is used to deploy key/cert. With defaults values dans `name` = "foo", key is -> /etc/nginx/ssl/foo/foo.key
|
||||
### Self signed
|
||||
|
||||
Create a self-signed pair and deploy it. Do not use this feature in production.
|
||||
|
||||
- `self_signed`: set true to use this featrure
|
||||
- `force`: optional feature (default: false), force regen pair (not idempotent)
|
||||
|
||||
### Acme
|
||||
|
||||
Uses acme.sh to create free certificates. It uses HTTP-01 challenge. Use this feature for standalone servers.
|
||||
|
||||
- `acme`: set true to use this feature. It uses `name` (can be a string or string list).
|
||||
|
||||
Have a look to [acme configuratuion](acme.md configuration).
|
||||
|
||||
Tips
|
||||
----
|
||||
|
||||
- Deploying key/cert is not mandatory with this role. You can manage it in other place ([letsencrypt](https://letsencrypt.org/)? :)). You just need to set `dest_cert` and `dest_key`!
|
||||
- In `nginx_sites`, `ssl_name` is mandatory. This role will search in `nginx_ssl_pairs` with site `name` (first in list if it's a list).
|
||||
- In `nginx_sites`, `ssl_name` is mandatory. This role will search in `nginx_ssl_pairs` with site `name` (first in list if it's a list).
|
||||
|
||||
Diffie-Hellman
|
||||
--------------
|
||||
|
@ -55,6 +72,10 @@ nginx_sites;
|
|||
- name: 'test-ssl3.local'
|
||||
proto: ['http', 'https']
|
||||
template: '_base'
|
||||
- name: 'test-self-signed.local'
|
||||
proto: ['http', 'https']
|
||||
template: '_base'
|
||||
ssl_name: 'this.is.self.signed'
|
||||
|
||||
nginx_ssl_pairs:
|
||||
- name: mysuperkey
|
||||
|
@ -68,5 +89,8 @@ nginx_ssl_pairs:
|
|||
-----END CERTIFICATE-----
|
||||
- name: test-ssl2.local
|
||||
acme: true
|
||||
- name: this.is.self.signed
|
||||
self_signed: true
|
||||
force: false
|
||||
```
|
||||
|
||||
|
|
|
@ -44,6 +44,16 @@
|
|||
notify: restart nginx
|
||||
no_log: not nginx_debug_role
|
||||
|
||||
- name: COMMAND | Create self-signed certificates
|
||||
command: "openssl req -new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509 -subj '/CN={{ item | nginx_site_name }}' -keyout {{ item | nginx_site_name + '.key' }} -out {{ item | nginx_site_name + '.crt' }}"
|
||||
args:
|
||||
chdir: "{{ nginx_ssl_dir + '/' + item | nginx_site_name }}"
|
||||
creates: "{% if item.force is defined and item.force %}/tmp/dummy{% else %}{{ nginx_ssl_dir + '/' + item | nginx_site_name + '/' + item | nginx_site_name + '.crt' }}{% endif %}"
|
||||
with_items: "{{ nginx_ssl_pairs }}"
|
||||
when: item.self_signed is defined
|
||||
notify: restart nginx
|
||||
no_log: not nginx_debug_role
|
||||
|
||||
- name: Check DH command status
|
||||
async_status:
|
||||
jid: "{{ dh.ansible_job_id }}"
|
||||
|
|
|
@ -76,6 +76,9 @@
|
|||
- '{{ ngrok.stdout }}'
|
||||
acme: true
|
||||
acme_port: 8888
|
||||
- name: 'test-ssl-selfsigned.local'
|
||||
self_signed: true
|
||||
force: false
|
||||
- name: 'test-ssl-predeployed.local'
|
||||
dest_key: "{{ int_ansible_ssl_dir }}/test.key"
|
||||
dest_cert: "{{ int_ansible_ssl_dir }}/test.crt"
|
||||
|
@ -224,6 +227,9 @@
|
|||
- name: 'test-ssl.local'
|
||||
proto: ['http', 'https']
|
||||
template: '_base'
|
||||
- name: 'test-ssl-selfsigned.local'
|
||||
proto: ['http', 'https']
|
||||
template: '_base'
|
||||
- name: 'test-ssl-predeployed.local'
|
||||
proto: ['http', 'https']
|
||||
template: '_base'
|
||||
|
@ -292,6 +298,7 @@
|
|||
- '/var/tmp'
|
||||
- '{{ nginx_root }}/test-htpasswd-all.local/public'
|
||||
- '{{ nginx_root }}/test-ssl.local/public'
|
||||
- '{{ nginx_root }}/test-ssl-selfsigned.local/public'
|
||||
- '{{ nginx_root }}/test-ssl-predeployed.local/public'
|
||||
- '{{ nginx_root }}/test-ssl-proxy-protocol.local/public'
|
||||
- '{{ nginx_root }}/{{ ngrok.stdout }}/public'
|
||||
|
@ -460,6 +467,7 @@
|
|||
failed_when: sslok.content.find('Index HTML test OK') == -1
|
||||
with_items:
|
||||
- 'test-ssl-predeployed.local'
|
||||
- 'test-ssl-selfsigned.local'
|
||||
- 'test-ssl.local'
|
||||
- '{{ ngrok.stdout }}'
|
||||
|
||||
|
|
Loading…
Reference in New Issue