From 899eca5f024f22b67aa032dd82aa4393b60b85e4 Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Sun, 14 Apr 2024 19:27:14 +0100 Subject: Make certificate updates work for nginx Currently, we obtain certificates from Let's Encrypt with standalone mode, so when we do renew, certbot tries to run it is own webserver on port 80, but this port is already in use by nginx. Stop nginx, before renewal. This is quite hacky, but should work. Proper solution is to split certificate role by standalone and non-standalone versions. --- roles/certificate/tasks/main.yml | 11 +++++++++++ roles/nginx/files/hooks/deploy/nginx.sh | 3 +++ roles/nginx/files/hooks/post/nginx.sh | 3 +++ roles/nginx/files/hooks/pre/nginx.sh | 3 +++ roles/nginx/files/nginx.sh | 3 --- roles/nginx/tasks/main.yml | 9 +++++++-- 6 files changed, 27 insertions(+), 5 deletions(-) create mode 100644 roles/nginx/files/hooks/deploy/nginx.sh create mode 100644 roles/nginx/files/hooks/post/nginx.sh create mode 100644 roles/nginx/files/hooks/pre/nginx.sh delete mode 100644 roles/nginx/files/nginx.sh diff --git a/roles/certificate/tasks/main.yml b/roles/certificate/tasks/main.yml index 5d25a63..a736e6b 100644 --- a/roles/certificate/tasks/main.yml +++ b/roles/certificate/tasks/main.yml @@ -13,3 +13,14 @@ -d {{ domains | join(' -d ') }} args: creates: '/etc/letsencrypt/live/{{ domains | first }}/fullchain.pem' + +# TODO: rewrite this role or make it more generic. +# +# Currently we reuse certificate role for web and mail servers, but they +# are actually quite different. +# * We can't start nginx without valid certificate, but can start postfix (and +# dovecot?). +# * We can serve acme challenge with nginx itself on renewal, but we need +# `--standalone` mode for mail server (or need to bring nginx). +# * It is undesirable to bring down nginx any time we are updating +# SSL certificates. diff --git a/roles/nginx/files/hooks/deploy/nginx.sh b/roles/nginx/files/hooks/deploy/nginx.sh new file mode 100644 index 0000000..ca022f8 --- /dev/null +++ b/roles/nginx/files/hooks/deploy/nginx.sh @@ -0,0 +1,3 @@ +#! /bin/sh + +systemctl reload nginx diff --git a/roles/nginx/files/hooks/post/nginx.sh b/roles/nginx/files/hooks/post/nginx.sh new file mode 100644 index 0000000..84e871d --- /dev/null +++ b/roles/nginx/files/hooks/post/nginx.sh @@ -0,0 +1,3 @@ +#! /bin/sh + +systemctl start nginx diff --git a/roles/nginx/files/hooks/pre/nginx.sh b/roles/nginx/files/hooks/pre/nginx.sh new file mode 100644 index 0000000..91b7633 --- /dev/null +++ b/roles/nginx/files/hooks/pre/nginx.sh @@ -0,0 +1,3 @@ +#! /bin/sh + +systemctl stop nginx diff --git a/roles/nginx/files/nginx.sh b/roles/nginx/files/nginx.sh deleted file mode 100644 index ca022f8..0000000 --- a/roles/nginx/files/nginx.sh +++ /dev/null @@ -1,3 +0,0 @@ -#! /bin/sh - -systemctl reload nginx diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml index 73cb4ad..8edb7db 100644 --- a/roles/nginx/tasks/main.yml +++ b/roles/nginx/tasks/main.yml @@ -45,11 +45,16 @@ - name: Copy nginx certificate renewal hook ansible.builtin.copy: - src: files/nginx.sh - dest: /etc/letsencrypt/renewal-hooks/deploy/nginx.sh + src: 'files/hooks/{{ item }}/nginx.sh' + dest: '/etc/letsencrypt/renewal-hooks/{{ item }}/nginx.sh' owner: root group: root mode: u+rwx,g+r,o+r + loop: + - pre + - post + # There is no deploy hook and it is intentional. As we currently stop nginx + # before renewal and start it after, so there is no need for reload. - name: Enable nginx systemd service ansible.builtin.service: -- cgit v1.2.3-70-g09d2