Automatically fetch X.509 certificates, and add them to git.

7 files changed, 69 insertions, 1 deletions

diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index 0c55535..ec1aaac 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -94,7 +94,7 @@
   # Ensure we don't fetch private data
   sudo: False
   fetch: src=/etc/dovecot/ssl/imap.fripost.org.pem
-         dest=certs/dovecot/
+         dest=certs/public/
          fail_on_missing=yes
          flat=yes
   tags:
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 6b1551f..499880f 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -24,6 +24,17 @@
 - name: Start Postfix
   service: name=postfix state=started
 
+- name: Fetch Postfix's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
+  fetch: src=/etc/postfix/ssl/smtp.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
+
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index 4302502..da6923b 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -78,6 +78,17 @@
 - name: Start Postfix
   service: name=postfix state=started
 
+- name: Fetch Postfix's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
+  fetch: src=/etc/ssl/certs/ssl-cert-snakeoil.pem
+         dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
+
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index a8be1fc..27e0554 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -109,3 +109,13 @@
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/git.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml
index a0aab68..4501d39 100644
--- a/roles/lists/tasks/nginx.yml
+++ b/roles/lists/tasks/nginx.yml
@@ -38,3 +38,13 @@
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/lists.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index 69bc033..ed6a3b4 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -140,3 +140,13 @@
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/mail.fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml
index 708f2a1..22a5831 100644
--- a/roles/wiki/tasks/main.yml
+++ b/roles/wiki/tasks/main.yml
@@ -103,6 +103,22 @@
   notify:
     - Restart Nginx
 
+- name: Start Nginx
+  service: name=nginx state=started
+  when: not (r1.changed or r2.changed or r3.changed)
+
+- meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  sudo: False
+  fetch: src=/etc/nginx/ssl/fripost.org.pem
+         dest=certs/public/
+         fail_on_missing=yes
+         flat=yes
+  tags:
+    - genkey
+
 - name: Create directory /var/www/fripost.org/autoconfig/mail
   file: path=/var/www/fripost.org/autoconfig/mail
         state=directory