From da2572ddb144086034eba1989ae909763e95c680 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Sun, 20 Dec 2015 14:13:08 +0100 Subject: Use the Let's Encrypt CA for our public certs. --- roles/lists/files/etc/nginx/sites-available/sympa | 8 ++++++-- roles/lists/tasks/nginx.yml | 20 +++----------------- 2 files changed, 9 insertions(+), 19 deletions(-) (limited to 'roles/lists') diff --git a/roles/lists/files/etc/nginx/sites-available/sympa b/roles/lists/files/etc/nginx/sites-available/sympa index ea0424f..5e469fa 100644 --- a/roles/lists/files/etc/nginx/sites-available/sympa +++ b/roles/lists/files/etc/nginx/sites-available/sympa @@ -4,10 +4,14 @@ server { server_name lists.fripost.org; + include snippets/acme-challenge.conf; + access_log /var/log/nginx/lists.access.log; error_log /var/log/nginx/lists.error.log info; - return 302 https://$host$request_uri; + location / { + return 301 https://$host$request_uri; + } } @@ -21,7 +25,7 @@ server { error_log /var/log/nginx/lists.error.log info; include snippets/ssl.conf; - ssl_certificate /etc/nginx/ssl/lists.fripost.org.pem; + ssl_certificate /etc/nginx/ssl/lists.fripost.org.chained.pem; ssl_certificate_key /etc/nginx/ssl/lists.fripost.org.key; location = / { diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml index 4501d39..21e769a 100644 --- a/roles/lists/tasks/nginx.yml +++ b/roles/lists/tasks/nginx.yml @@ -1,26 +1,12 @@ - name: Install Nginx apt: pkg=nginx -- name: Generate a private key and a X.509 certificate for Nginx - command: genkeypair.sh x509 - --pubkey=/etc/nginx/ssl/lists.fripost.org.pem - --privkey=/etc/nginx/ssl/lists.fripost.org.key - --ou=WWW --cn=lists.fripost.org --dns=lists.fripost.org - -t rsa -b 4096 -h sha512 - register: r1 - changed_when: r1.rc == 0 - failed_when: r1.rc > 1 - notify: - - Restart Nginx - tags: - - genkey - - name: Copy /etc/nginx/sites-available/sympa copy: src=etc/nginx/sites-available/sympa dest=/etc/nginx/sites-available/sympa owner=root group=root mode=0644 - register: r2 + register: r1 notify: - Restart Nginx @@ -29,13 +15,13 @@ dest=/etc/nginx/sites-enabled/sympa owner=root group=root state=link - register: r3 + register: r2 notify: - Restart Nginx - name: Start nginx service: name=nginx state=started - when: not (r1.changed or r2.changed or r3.changed) + when: not (r1.changed or r2.changed) - meta: flush_handlers -- cgit v1.2.3