Generate certs for Dovecot and Nginx if they are not there.

5 files changed, 37 insertions, 7 deletions

diff --git a/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf b/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
index c727f4b..c5e61d7 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
@@ -21,8 +21,8 @@ local 172.16.0.1 {
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/dovecot/dovecot.pem
-ssl_key = </etc/dovecot/private/dovecot.pem
+ssl_cert = </etc/dovecot/ssl/imap.fripost.org.pem
+ssl_key = </etc/dovecot/ssl/imap.fripost.org.key
 
 # If key file is password protected, give the password here. Alternatively
 # give it when starting dovecot with -p parameter. Since this file is often
diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index 6191a50..c9471f3 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -62,12 +62,24 @@
         owner=vmail group=vmail
         mode=0700
 
+- name: Generate a private key and a X.509 certificate for Dovecot
+  command: genkeypair.sh x509
+                         --pubkey=/etc/dovecot/ssl/imap.fripost.org.pem
+                         --privkey=/etc/dovecot/ssl/imap.fripost.org.key
+                         --dns imap.fripost.org
+                         -t rsa -b 4096 -h sha512
+  register: r1
+  changed_when: r1.rc == 0
+  failed_when: r1.rc > 1
+  notify:
+    - Restart Dovecot
+
 - name: Configure Dovecot
   copy: src=etc/dovecot/{{ item }}
         dest=/etc/dovecot/{{ item }}
         owner=root group=root
         mode=0644
-  register: r
+  register: r2
   with_items:
     - conf.d/10-auth.conf
     - conf.d/10-logging.conf
@@ -87,6 +99,6 @@
 
 - name: Start Dovecot
   service: name=dovecot state=started
-  when: not r.changed
+  when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
diff --git a/roles/common/tasks/ipsec.yml b/roles/common/tasks/ipsec.yml
index d773c1c..0dbf3e1 100644
--- a/roles/common/tasks/ipsec.yml
+++ b/roles/common/tasks/ipsec.yml
@@ -8,8 +8,8 @@
                          --dns {{ inventory_hostname }}
                          -t ecdsa -b secp521r1 -h sha512
   register: r1
-  failed_when: r1.rc > 1
   changed_when: r1.rc == 0
+  failed_when: r1.rc > 1
   notify:
     - Restart IPSec
 
diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube
index 161b940..0c54bf2 100644
--- a/roles/webmail/files/etc/nginx/sites-available/roundcube
+++ b/roles/webmail/files/etc/nginx/sites-available/roundcube
@@ -20,8 +20,8 @@ server {
     root         /var/lib/roundcube;
 
     include ssl/config;
-    ssl_certificate     /etc/ssl/certs/ssl-cert-snakeoil.pem;
-    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    ssl_certificate     /etc/nginx/ssl/mail.fripost.org.pem;
+    ssl_certificate_key /etc/nginx/ssl/mail.fripost.org.key;
 
     location = /favicon.ico {
         root          /usr/share/roundcube/skins/default/images;
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index c737fd1..d79304e 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -78,11 +78,24 @@
 - name: Start php5-fpm
   service: name=php5-fpm state=started
 
+- name: Generate a private key and a X.509 certificate for Nginx
+  command: genkeypair.sh x509
+                         --pubkey=/etc/nginx/ssl/mail.fripost.org.pem
+                         --privkey=/etc/nginx/ssl/mail.fripost.org.key
+                         --dns mail.fripost.org
+                         -t rsa -b 4096 -h sha512
+  register: r1
+  changed_when: r1.rc == 0
+  failed_when: r1.rc > 1
+  notify:
+    - Restart Nginx
+
 - name: Copy /etc/nginx/sites-available/roundcube
   copy: src=etc/nginx/sites-available/roundcube
         dest=/etc/nginx/sites-available/roundcube
         owner=root group=root
         mode=0644
+  register: r2
   notify:
     - Restart Nginx
 
@@ -91,7 +104,12 @@
         dest=/etc/nginx/sites-enabled/roundcube
         owner=root group=root
         state=link force=yes
+  register: r3
   notify:
     - Restart Nginx
 
+- name: Start Nginx
+  service: name=nginx state=started
+  when: not (r1.changed or r2.changed or r3.changed)
+
 - meta: flush_handlers