initial commit

defaults/main.yml

@@ -0,0 +1,57 @@
+# compile acme-client when source repo changed
+acme_compile: true
+
+# add renew_script with reload commands
+acme_renew_script: true
+
+# set true to only run acme-client for all configured domains
+acme_justrun: false
+
+# add cronjob for renew_script or every configured domain if
+# acme_renew_script is set to false
+acme_add_cronjob: true
+
+src_dir: /usr/local/src
+acme_renew_script_path: /usr/local/sbin
+
+acme_build_dependencies_apt:
+  - git
+  - automake
+  - autotools-dev
+  - libbsd-dev
+  - bison
+  - libssl-dev
+
+acme_build_dependencies_zypper:
+  - git
+  - autoconf
+  - automake
+  - make
+  - gcc
+  - openssl-devel
+  - bison
+
+acme_authorities:
+  - name: letsencrypt
+    key: "/etc/ssl/private/acme_authority.key"
+    api_url: "https://acme-v02.api.letsencrypt.org/directory"
+
+# For testing prupose its recommended to use the staging url
+# https://acme-staging-v02.api.letsencrypt.org/directory
+
+acme_hosts: []
+#  - domain: www.exmaple.com
+#    alt_names:
+#      - example.com
+#      - git.exmaple.com
+#    key: "/etc/ssl/private/example.com.key"
+#    cert: "path_cert"
+#    chain_cert: "chain_cert"
+#    full_chain_cert: "full_cert"
+#    challengedir: /var/www/acme/example.com
+#    authority: letsencrypt
+#    reload_command: "systemctl reload nginx"
+#  - domain: www.doamin2.com
+#    key: "/etc/ssl/private/domain2.com.key"
+#    cert: "path_cert"
+#    full_chain_cert: "full_cert"

handlers/main.yml

@@ -0,0 +1,31 @@
+- name: acme_autoreconf
+  shell: "autoreconf -i"
+  args:
+    chdir: "{{src_dir}}/acme-client-portable"
+  notify: acme_configure
+
+- name: acme_configure
+  shell: "./configure"
+  args:
+    chdir: "{{src_dir}}/acme-client-portable"
+  notify: acme_build
+
+- name: acme_build
+  make:
+    chdir: "{{src_dir}}/acme-client-portable"
+    target: "{{item}}"
+  loop:
+    - clean
+    - all-am
+    - install
+
+- name: run renew script
+  shell: "{{acme_renew_script_path}}/renew_certs"
+  when: acme_renew_script
+  listen: "renew certs"
+
+- name: run acme-client
+  shell: "acme-client {{item.domain}}"
+  when: not acme_renew_script
+  listen: "renew certs"
+  loop: "{{acme_hosts}}"

meta/main.yml

@@ -0,0 +1,8 @@
+galaxy_info:
+  role_name: acme-client
+  author: Martin
+  description: openbsd acme-client portable
+  license: license (MIT)
+  min_ansible_version: 1.2
+  galaxy_tags: [acme]
+dependencies: []

tasks/compile_acme.yml

@@ -0,0 +1,16 @@
+- name: download acme-portable
+  git:
+    repo: https://github.com/graywolf/acme-client-portable
+    dest: "{{src_dir}}/acme-client-portable"
+    version: HEAD # user newest master
+  notify: acme_autoreconf
+
+- name: install build dependencies (debian)
+  apt:
+    name: "{{acme_build_dependencies_apt}}"
+  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
+
+- name: install build dependencies (openSUSE)
+  apt:
+    name: "{{acme_build_dependencies_zypper}}"
+  when: ansible_distribution == 'openSUSE Leap'

tasks/main.yml

@@ -0,0 +1,53 @@
+- name: get openssl version
+  command: "openssl version"
+  register: openssl_version
+  changed_when: false
+
+- fail:
+    msg: "OpenSSL too old!"
+  when: openssl_version.stdout.split()[1] is version('1.1.1', '<')
+
+- name: compile acme-client
+  include_tasks: compile_acme.yml
+  when: acme_compile and not acme_justrun
+
+- name: add config
+  template:
+    src: acme.j2
+    dest: /etc/acme-client.conf
+  notify: "renew certs"
+
+- name: add renew script
+  template:
+    src: renew_certs.j2
+    dest: "{{acme_renew_script_path}}/renew_certs"
+    owner: root
+    group: root
+    mode: 0755
+  when: acme_renew_script
+
+- name: add daily cronjob (renew_script)
+  cron:
+    name: renew certs
+    minute: "0"
+    hour: "4"
+    job: "{{acme_renew_script_path}}/renew_certs"
+  when: acme_renew_script and acme_add_cronjob
+
+- name: add daily cronjobs
+  cron:
+    name: "renew certs for domain {{item.domain}}"
+    minute: "0"
+    hour: "4"
+    job: "/usr/local/bin/acme-client {{item.domain}}"
+  loop: "{{acme_hosts}}"
+  loop_control:
+    label: "{{item.domain}}"
+  when: not acme_renew_script and acme_add_cronjob
+
+- name: run acme-client
+  shell: "/usr/local/bin/acme-client {{item.domain}}"
+  when: acme_justrun
+  loop: "{{acme_hosts}}"
+  loop_control:
+    label: "{{item.domain}}"

templates/acme.j2

@@ -0,0 +1,32 @@
+# {{ ansible_managed }}
+
+{% for authority in acme_authorities %}
+authority {{authority.name}} {
+  api url "{{authority.api_url}}"
+  account key "{{authority.key}}"
+}
+{% endfor %}
+{% for domain in acme_hosts %}
+
+domain {{domain.domain}} {
+{% if domain.alt_names is defined %}
+  alternative names { {{domain.alt_names | join(' ')}} }
+{% endif %}
+  domain key "{{domain.key}}"
+{% if domain.cert is defined %}
+  domain certificate "{{domain.cert}}"
+{% endif %}
+{% if domain.chain_cert is defined %}
+  domain chain certificate "{{domain.chain_cert}}"
+{% endif %}
+{% if domain.full_chain_cert is defined %}
+  domain full chain certificate "{{domain.full_chain_cert}}"
+{% endif %}
+{% if domain.authority is defined %}
+  sign with {{domain.authority}}
+{% endif %}
+{% if domain.challengedir is defined%}
+  challengedir "{{domain.challengedir}}"
+{% endif %}
+}
+{% endfor %}

templates/renew_certs.j2

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# {{ ansible_managed }}
+
+{% for domain in acme_hosts %}
+
+# domain {{domain.domain}}
+/usr/local/bin/acme-client {{domain.domain}}
+RETURN=$?
+if [ $RETURN -eq 0 ]
+then
+{% if domain.reload_command is defined %}
+	# reload command
+	{{domain.reload_command}}
+{% else %}
+	# no reload command defined
+	:
+{% endif %}
+elif [ $RETURN -eq 2 ]
+then
+	# clean
+	:
+else
+	# error
+	:
+fi
+{% endfor %}