summaryrefslogtreecommitdiffstats
path: root/roles/wiki/tasks/main.yml
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2016-07-12 03:10:33 +0200
committerGuilhem Moulin <guilhem@fripost.org>2016-07-12 03:10:33 +0200
commitef430522256013665205cdda05636846cc622251 (patch)
tree0912b6175af9e97fa76aaf47613bd1926893dc67 /roles/wiki/tasks/main.yml
parent4e347178a85468cb2a6451a3a57c3379f832ca97 (diff)
nginx: Don't hard-code the HPKP headers.
Instead, lookup the pubkeys and compute the digests on the fly. But never modify the actual header snippet to avoid locking our users out.
Diffstat (limited to 'roles/wiki/tasks/main.yml')
-rw-r--r--roles/wiki/tasks/main.yml13
1 files changed, 12 insertions, 1 deletions
diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml
index 4a64c2f..ff2d724 100644
--- a/roles/wiki/tasks/main.yml
+++ b/roles/wiki/tasks/main.yml
@@ -76,43 +76,54 @@
mode=0644
register: r1
with_items:
- website
- wiki
notify:
- Restart Nginx
- name: Create /etc/nginx/sites-enabled/{wiki,website}
file: src=../sites-available/{{ item }}
dest=/etc/nginx/sites-enabled/{{ item }}
owner=root group=root
state=link force=yes
register: r2
with_items:
- website
- wiki
notify:
- Restart Nginx
+- name: Copy HPKP header snippet
+ # never modify the pined pubkeys as we don't want to lock out our users
+ template: src=etc/nginx/snippets/fripost.org.hpkp-hdr.j2
+ dest=/etc/nginx/snippets/fripost.org.hpkp-hdr
+ validate=/bin/false
+ owner=root group=root
+ mode=0644
+ register: r3
+ notify:
+ - Restart Nginx
+
- name: Start Nginx
service: name=nginx state=started
- when: not (r1.changed or r2.changed)
+ when: not (r1.changed or r2.changed or r3.changed)
- meta: flush_handlers
- name: Fetch Nginx's X.509 certificate
# Ensure we don't fetch private data
become: False
fetch_cmd: cmd="openssl x509 -noout -pubkey"
stdin=/etc/nginx/ssl/www.fripost.org.pem
dest=certs/public/fripost.org.pub
tags:
- genkey
- name: Create directory /var/www/fripost.org/autoconfig/mail
file: path=/var/www/fripost.org/autoconfig/mail
state=directory
owner=root group=root
mode=0755
- name: Copy /var/www/fripost.org/autoconfig/mail/config-v1.1.xml
copy: src=var/www/fripost.org/autoconfig/mail/config-v1.1.xml