Automatically fetch X.509 certificates, and add them to git.

7 files changed, 69 insertions, 1 deletions

diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index 0c55535..ec1aaac 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -77,41 +77,41 @@
         mode=0755
 
 - name: Generate a private key and a X.509 certificate for Dovecot
   command: genkeypair.sh x509
                          --pubkey=/etc/dovecot/ssl/imap.fripost.org.pem
                          --privkey=/etc/dovecot/ssl/imap.fripost.org.key
                          --ou=IMAP --cn=imap.fripost.org
                          -t rsa -b 4096 -h sha512
   register: r1
   changed_when: r1.rc == 0
   failed_when: r1.rc > 1
   notify:
     - Restart Dovecot
   tags:
     - genkey
 
 - name: Fetch Dovecot's X.509 certificate
   # Ensure we don't fetch private data
   sudo: False
   fetch: src=/etc/dovecot/ssl/imap.fripost.org.pem
-         dest=certs/dovecot/
+         dest=certs/public/
          fail_on_missing=yes
          flat=yes
   tags:
     - genkey
 
 - name: Configure Dovecot
   copy: src=etc/dovecot/{{ item }}
         dest=/etc/dovecot/{{ item }}
         owner=root group=root
         mode=0644
   register: r2
   with_items:
     - conf.d/10-auth.conf
     - conf.d/10-logging.conf
     - conf.d/10-mail.conf
     - conf.d/10-master.conf
     - conf.d/10-ssl.conf
     - conf.d/15-mailboxes.conf
     - conf.d/20-imap.conf
     - conf.d/20-lmtp.conf
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 6b1551f..499880f 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -7,40 +7,51 @@
 - name: Configure Postfix
   template: src=etc/postfix/main.cf.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
             owner=root group=root
             mode=0644
   notify:
     - Reload Postfix
 
 - name: Copy the Regex to anonymize senders
   # no need to reload upon change, as cleanup(8) is short-running
   copy: src=etc/postfix/anonymize_sender.pcre
         dest=/etc/postfix-{{ postfix_instance[inst].name }}/anonymize_sender.pcre
         owner=root group=root
         mode=0644
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
 
+- name: Fetch Postfix's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
+  fetch: src=/etc/postfix/ssl/smtp.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
+
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
         dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   tags:
     - munin
     - munin-node
   notify:
     - Restart munin-node
 
 - name: Install 'postfix_stats_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_stats_
         dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   with_items:
     - smtpd
     - qmgr
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index 4302502..da6923b 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -61,40 +61,51 @@
 - name: Compile the Postfix transport maps
   # trivial-rewrite(8) is a long-running process, so it's safer to reload
   postmap: instance={{ postfix_instance[inst].name }}
            src=/etc/postfix-{{ postfix_instance[inst].name }}/virtual/transport db=cdb
            owner=root group=root
            mode=0644
   notify:
     - Reload Postfix
 
 - name: Copy reserved-alias.pl
   copy: src=usr/local/bin/reserved-alias.pl
         dest=/usr/local/bin/reserved-alias.pl
         owner=root group=root
         mode=0755
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
 
+- name: Fetch Postfix's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
+  fetch: src=/etc/ssl/certs/ssl-cert-snakeoil.pem
+         dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
+
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
         dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   tags:
     - munin
     - munin-node
   notify:
     - Restart munin-node
 
 - name: Install 'postfix_stats_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_stats_
         dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   with_items:
     - postscreen
     - smtpd
diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index a8be1fc..27e0554 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -92,20 +92,30 @@
         owner=root group=root
         mode=0644
   register: r2
   notify:
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/git
   file: src=../sites-available/git
         dest=/etc/nginx/sites-enabled/git
         owner=root group=root
         state=link force=yes
   register: r3
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/git.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml
index a0aab68..4501d39 100644
--- a/roles/lists/tasks/nginx.yml
+++ b/roles/lists/tasks/nginx.yml
@@ -21,20 +21,30 @@
         owner=root group=root
         mode=0644
   register: r2
   notify:
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/sympa
   file: src=../sites-available/sympa
         dest=/etc/nginx/sites-enabled/sympa
         owner=root group=root
         state=link
   register: r3
   notify:
     - Restart Nginx
 
 - name: Start nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/lists.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index 69bc033..ed6a3b4 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -123,20 +123,30 @@
         owner=root group=root
         mode=0644
   register: r2
   notify:
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/roundcube
   file: src=../sites-available/roundcube
         dest=/etc/nginx/sites-enabled/roundcube
         owner=root group=root
         state=link force=yes
   register: r3
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/mail.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml
index 708f2a1..22a5831 100644
--- a/roles/wiki/tasks/main.yml
+++ b/roles/wiki/tasks/main.yml
@@ -86,31 +86,47 @@
         mode=0644
   register: r2
   with_items:
     - website
     - wiki
   notify:
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/{wiki,website}
   file: src=../sites-available/{{ item }}
         dest=/etc/nginx/sites-enabled/{{ item }}
         owner=root group=root
         state=link force=yes
   register: r3
   with_items:
     - website
     - wiki
   notify:
     - Restart Nginx
 
+- name: Start Nginx
+  service: name=nginx state=started
+  when: not (r1.changed or r2.changed or r3.changed)
+
+- meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
+
 - name: Create directory /var/www/fripost.org/autoconfig/mail
   file: path=/var/www/fripost.org/autoconfig/mail
         state=directory
         owner=root group=root
         mode=0755
 
 - name: Copy /var/www/fripost.org/autoconfig/mail/config-v1.1.xml
   copy: src=var/www/fripost.org/autoconfig/mail/config-v1.1.xml
         dest=/var/www/fripost.org/autoconfig/mail/config-v1.1.xml
         owner=root group=root
         mode=0644