diff options
Diffstat (limited to 'tasks')
| -rw-r--r-- | tasks/jail_ingress.yml | 63 |
1 files changed, 53 insertions, 10 deletions
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml index b40148e..75e364e 100644 --- a/tasks/jail_ingress.yml +++ b/tasks/jail_ingress.yml @@ -13,31 +13,74 @@ owner: root group: wheel mode: "0644" + register: ingress_pf_conf - name: Reload pf.conf shell: jexec ingress pfctl -f /etc/pf.conf + when: ingress_pf_conf.changed + +- name: Check if gateway mode is enabled + shell: jexec ingress sysrc gateway_enable | grep -q "YES" + register: ingress_gateway_enabled + failed_when: false + changed_when: false - name: Enable gateway mode - shell: jexec ingress sysrc gateway_enable=YES && jexec ingress sysctl net.inet.ip.forwarding=1 + shell: jexec ingress sysrc gateway_enable=YES + when: ingress_gateway_enabled.rc != 0 + +- name: Check if IP forwarding is enabled + shell: jexec ingress sysctl net.inet.ip.forwarding | grep -q "1" + register: ingress_ip_forwarding_enabled + failed_when: false + changed_when: false + +- name: Enable IP forwarding + shell: jexec ingress sysctl net.inet.ip.forwarding=1 + when: ingress_ip_forwarding_enabled.rc != 0 + +- name: Check if pf enabled + shell: jexec ingress sysrc pf_enable | grep -q "YES" + register: ingress_pf_enabled + failed_when: false + changed_when: false - name: Enable pf shell: jexec ingress sysrc pf_enable=YES + when: ingress_pf_enabled.rc != 0 - name: Check if pf is running shell: service -j ingress pf status - register: pf_status - changed_when: pf_status.rc != 0 + register: ingress_pf_status + changed_when: ingress_pf_status.rc != 0 - name: Start pf shell: service -j ingress pf start - when: pf_status.rc != 0 -# -#- name: Generate LetsEncrypt certs -# shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }} -# loop: "{{ ingress_routes | map(attribute='host') | unique }}" + when: ingress_pf_status.rc != 0 + +- name: Copy acme-dns-auth.py + copy: + src: templates/ingress/acme-dns-auth.py + dest: /usr/local/jails/containers/ingress/usr/local/bin/acme-dns-auth.py + owner: root + group: wheel + mode: "0755" + +- name: Check if LetsEncrypt certs are generated + shell: ls /usr/local/jails/containers/ingress/usr/local/etc/letsencrypt/live/{{ cert_name }} + register: cert_exists + failed_when: false + changed_when: false + +- name: Manually get certs with certbot and DNS challenge + pause: + prompt: | + /usr/local/etc/letsencrypt/live/{{ cert_name }} does not exist. This means that this is the first run of this playbook. + The {{ cert_name }} cert contains all of the @ and * certs for all domains. + Check the ingress crontab template and run the certbot command manually in the ingress jail. Remove the "-n" flag. + Add the requested DNS records manually into Hetzner DNS. Continue after this is done. + when: cert_exists.rc != 0 -# It's important to run this after generating certs, because nginx.conf refers to files -# generated by certbot. Certbot will fail validation if nginx.conf is configured too early. - name: Configure nginx.conf template: src: ingress/usr_local_etc_nginx_nginx.conf.j2 |