From 03bc468e0dab47c9720d3ffa78ab3880d11870b5 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 2 Dec 2015 23:14:30 +0100 Subject: Automatically fetch X.509 certificates, and add them to git. --- roles/IMAP/tasks/imap.yml | 2 +- roles/MSA/tasks/main.yml | 11 +++++++++++ roles/MX/tasks/main.yml | 11 +++++++++++ roles/git/tasks/cgit.yml | 10 ++++++++++ roles/lists/tasks/nginx.yml | 10 ++++++++++ roles/webmail/tasks/roundcube.yml | 10 ++++++++++ roles/wiki/tasks/main.yml | 16 ++++++++++++++++ 7 files changed, 69 insertions(+), 1 deletion(-) (limited to 'roles') diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml index 0c55535..ec1aaac 100644 --- a/roles/IMAP/tasks/imap.yml +++ b/roles/IMAP/tasks/imap.yml @@ -94,7 +94,7 @@ # Ensure we don't fetch private data sudo: False fetch: src=/etc/dovecot/ssl/imap.fripost.org.pem - dest=certs/dovecot/ + dest=certs/public/ fail_on_missing=yes flat=yes tags: diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml index 6b1551f..499880f 100644 --- a/roles/MSA/tasks/main.yml +++ b/roles/MSA/tasks/main.yml @@ -24,6 +24,17 @@ - name: Start Postfix service: name=postfix state=started +- name: Fetch Postfix's X.509 certificate + # Ensure we don't fetch private data + sudo: False + # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file` + fetch: src=/etc/postfix/ssl/smtp.fripost.org.pem + dest=certs/public/ + fail_on_missing=yes + flat=yes + tags: + - genkey + - name: Install 'postfix_mailqueue_' Munin wildcard plugin file: src=/usr/local/share/munin/plugins/postfix_mailqueue_ diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml index 4302502..da6923b 100644 --- a/roles/MX/tasks/main.yml +++ b/roles/MX/tasks/main.yml @@ -78,6 +78,17 @@ - name: Start Postfix service: name=postfix state=started +- name: Fetch Postfix's X.509 certificate + # Ensure we don't fetch private data + sudo: False + # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file` + fetch: src=/etc/ssl/certs/ssl-cert-snakeoil.pem + dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem + fail_on_missing=yes + flat=yes + tags: + - genkey + - name: Install 'postfix_mailqueue_' Munin wildcard plugin file: src=/usr/local/share/munin/plugins/postfix_mailqueue_ diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml index a8be1fc..27e0554 100644 --- a/roles/git/tasks/cgit.yml +++ b/roles/git/tasks/cgit.yml @@ -109,3 +109,13 @@ when: not (r1.changed or r2.changed or r3.changed) - meta: flush_handlers + +- name: Fetch Nginx's X.509 certificate + # Ensure we don't fetch private data + sudo: False + fetch: src=/etc/nginx/ssl/git.fripost.org.pem + dest=certs/public/ + fail_on_missing=yes + flat=yes + tags: + - genkey diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml index a0aab68..4501d39 100644 --- a/roles/lists/tasks/nginx.yml +++ b/roles/lists/tasks/nginx.yml @@ -38,3 +38,13 @@ when: not (r1.changed or r2.changed or r3.changed) - meta: flush_handlers + +- name: Fetch Nginx's X.509 certificate + # Ensure we don't fetch private data + sudo: False + fetch: src=/etc/nginx/ssl/lists.fripost.org.pem + dest=certs/public/ + fail_on_missing=yes + flat=yes + tags: + - genkey diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml index 69bc033..ed6a3b4 100644 --- a/roles/webmail/tasks/roundcube.yml +++ b/roles/webmail/tasks/roundcube.yml @@ -140,3 +140,13 @@ when: not (r1.changed or r2.changed or r3.changed) - meta: flush_handlers + +- name: Fetch Nginx's X.509 certificate + # Ensure we don't fetch private data + sudo: False + fetch: src=/etc/nginx/ssl/mail.fripost.org.pem + dest=certs/public/ + fail_on_missing=yes + flat=yes + tags: + - genkey diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml index 708f2a1..22a5831 100644 --- a/roles/wiki/tasks/main.yml +++ b/roles/wiki/tasks/main.yml @@ -103,6 +103,22 @@ notify: - Restart Nginx +- name: Start Nginx + service: name=nginx state=started + when: not (r1.changed or r2.changed or r3.changed) + +- meta: flush_handlers + +- name: Fetch Nginx's X.509 certificate + # Ensure we don't fetch private data + sudo: False + fetch: src=/etc/nginx/ssl/fripost.org.pem + dest=certs/public/ + fail_on_missing=yes + flat=yes + tags: + - genkey + - name: Create directory /var/www/fripost.org/autoconfig/mail file: path=/var/www/fripost.org/autoconfig/mail state=directory -- cgit v1.2.3