From 98deb6b468c52d09c69c699b02ab16791f557beb Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Thu, 21 Dec 2023 18:08:22 +0000 Subject: Enable certbot for certificates renewal --- roles/essential/tasks/atop.yml | 2 +- roles/web/files/certbot/certbot.service | 6 ++++ roles/web/files/certbot/certbot.timer | 10 ++++++ roles/web/files/nginx | 12 ------- roles/web/files/nginx.conf | 55 --------------------------------- roles/web/files/nginx/nginx.conf | 55 +++++++++++++++++++++++++++++++++ roles/web/files/nginx/nginx.logrotate | 12 +++++++ roles/web/tasks/certbot.yml | 27 ++++++++++++++++ roles/web/tasks/main.yml | 1 + roles/web/tasks/nginx.yml | 6 ++-- 10 files changed, 115 insertions(+), 71 deletions(-) create mode 100644 roles/web/files/certbot/certbot.service create mode 100644 roles/web/files/certbot/certbot.timer delete mode 100644 roles/web/files/nginx delete mode 100644 roles/web/files/nginx.conf create mode 100644 roles/web/files/nginx/nginx.conf create mode 100644 roles/web/files/nginx/nginx.logrotate create mode 100644 roles/web/tasks/certbot.yml diff --git a/roles/essential/tasks/atop.yml b/roles/essential/tasks/atop.yml index ccc699c..7617f68 100644 --- a/roles/essential/tasks/atop.yml +++ b/roles/essential/tasks/atop.yml @@ -28,7 +28,7 @@ notify: - Restart atop -- name: Enable atop systemd unit and logrotate timer +- name: Enable atop systemd service and logrotate timer ansible.builtin.service: name: '{{ item }}' enabled: yes diff --git a/roles/web/files/certbot/certbot.service b/roles/web/files/certbot/certbot.service new file mode 100644 index 0000000..bea307c --- /dev/null +++ b/roles/web/files/certbot/certbot.service @@ -0,0 +1,6 @@ +[Unit] +Description=Let's Encrypt renewal + +[Service] +Type=oneshot +ExecStart=/usr/bin/certbot renew --agree-tos --deploy-hook "systemctl reload nginx" diff --git a/roles/web/files/certbot/certbot.timer b/roles/web/files/certbot/certbot.timer new file mode 100644 index 0000000..565b4ee --- /dev/null +++ b/roles/web/files/certbot/certbot.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Renewal of Let's Encrypt's certificates + +[Timer] +OnCalendar=daily +OnCalendar=0/12:12:00 +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/roles/web/files/nginx b/roles/web/files/nginx deleted file mode 100644 index da8ba47..0000000 --- a/roles/web/files/nginx +++ /dev/null @@ -1,12 +0,0 @@ -/var/log/nginx/*log { - missingok - notifempty - create 640 http root - daily - rotate 14 - sharedscripts - compress - postrotate - test ! -r /run/nginx.pid || kill -USR1 `cat /run/nginx.pid` - endscript -} diff --git a/roles/web/files/nginx.conf b/roles/web/files/nginx.conf deleted file mode 100644 index ce8302d..0000000 --- a/roles/web/files/nginx.conf +++ /dev/null @@ -1,55 +0,0 @@ -# Run workers under http user. -user http; - -# Set number of worker processes to number of available CPU cores. -worker_processes 1; - -# Log errors in a separate file. -error_log /var/log/nginx/error.log; - -# Write a PID-file. -pid /run/nginx.pid; - - -events { - # Maximum number of simultaneous connections that can be opened by a worker - # process. - # worker_connections 512; -} - - -http { - include mime.types; - default_type application/octet-stream; - - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - - # Use log_format defined above. - access_log /var/log/nginx/access.log main; - - # Enable use of sendfile. - sendfile on; - - # Set keepalive timeout to 65 seconds. - keepalive_timeout 65; - - # Set types_hash_max_size to 2048 to avoid warning in logs. - types_hash_max_size 4096; - - # Load configs for all enabled sites. - include /etc/nginx/sites-enabled/*; - - server { - # Listen on port 80 and become a default server. - listen 80; - listen [::]:80 default_server; - - # Serve as a default server block. - server_name _; - - # Redirect any non-matched request to default page. - return 301 https://ilvokhin.com$request_uri; - } -} diff --git a/roles/web/files/nginx/nginx.conf b/roles/web/files/nginx/nginx.conf new file mode 100644 index 0000000..ce8302d --- /dev/null +++ b/roles/web/files/nginx/nginx.conf @@ -0,0 +1,55 @@ +# Run workers under http user. +user http; + +# Set number of worker processes to number of available CPU cores. +worker_processes 1; + +# Log errors in a separate file. +error_log /var/log/nginx/error.log; + +# Write a PID-file. +pid /run/nginx.pid; + + +events { + # Maximum number of simultaneous connections that can be opened by a worker + # process. + # worker_connections 512; +} + + +http { + include mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + # Use log_format defined above. + access_log /var/log/nginx/access.log main; + + # Enable use of sendfile. + sendfile on; + + # Set keepalive timeout to 65 seconds. + keepalive_timeout 65; + + # Set types_hash_max_size to 2048 to avoid warning in logs. + types_hash_max_size 4096; + + # Load configs for all enabled sites. + include /etc/nginx/sites-enabled/*; + + server { + # Listen on port 80 and become a default server. + listen 80; + listen [::]:80 default_server; + + # Serve as a default server block. + server_name _; + + # Redirect any non-matched request to default page. + return 301 https://ilvokhin.com$request_uri; + } +} diff --git a/roles/web/files/nginx/nginx.logrotate b/roles/web/files/nginx/nginx.logrotate new file mode 100644 index 0000000..da8ba47 --- /dev/null +++ b/roles/web/files/nginx/nginx.logrotate @@ -0,0 +1,12 @@ +/var/log/nginx/*log { + missingok + notifempty + create 640 http root + daily + rotate 14 + sharedscripts + compress + postrotate + test ! -r /run/nginx.pid || kill -USR1 `cat /run/nginx.pid` + endscript +} diff --git a/roles/web/tasks/certbot.yml b/roles/web/tasks/certbot.yml new file mode 100644 index 0000000..bc0e50e --- /dev/null +++ b/roles/web/tasks/certbot.yml @@ -0,0 +1,27 @@ +- name: Install certbot + ansible.builtin.package: + name: + - certbot + state: present + +- name: Configure certbot systemd service + ansible.builtin.copy: + src: roles/web/files/certbot/certbot.service + dest: /usr/lib/systemd/system + owner: root + group: root + mode: u+rw,g+r,o+r + +- name: Configure certbot systemd timer + ansible.builtin.copy: + src: roles/web/files/certbot/certbot.timer + dest: /usr/lib/systemd/system + owner: root + group: root + mode: u+rw,g+r,o+r + +- name: Enable certbot systemd timer + ansible.builtin.service: + name: certbot.timer + enabled: yes + state: started diff --git a/roles/web/tasks/main.yml b/roles/web/tasks/main.yml index 5b94d1b..831d6d6 100644 --- a/roles/web/tasks/main.yml +++ b/roles/web/tasks/main.yml @@ -1,2 +1,3 @@ - ansible.builtin.import_tasks: roles/web/tasks/logrotate.yml - ansible.builtin.import_tasks: roles/web/tasks/nginx.yml +- ansible.builtin.import_tasks: roles/web/tasks/certbot.yml diff --git a/roles/web/tasks/nginx.yml b/roles/web/tasks/nginx.yml index 108bb61..43f7058 100644 --- a/roles/web/tasks/nginx.yml +++ b/roles/web/tasks/nginx.yml @@ -4,7 +4,7 @@ - nginx state: present -- name: Enable nginx systemd unit +- name: Enable nginx systemd service ansible.builtin.service: name: nginx enabled: yes @@ -23,7 +23,7 @@ - name: Configure nginx ansible.builtin.copy: - src: roles/web/files/nginx.conf + src: roles/web/files/nginx/nginx.conf dest: /etc/nginx/nginx.conf owner: root group: root @@ -33,7 +33,7 @@ - name: Configure nginx logrotate ansible.builtin.copy: - src: roles/web/files/nginx + src: roles/web/files/nginx/nginx.logrotate dest: /etc/logrotate.d/nginx owner: root group: root -- cgit v1.2.3-70-g09d2