blob: 2844c12054cc6d873673507e0379cc5718770006 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
|
- name: Install packages inside jail
loop:
- { jail: ingress, package: nginx }
- { jail: ingress, package: py311-certbot }
- { jail: ingress, package: py311-certbot-nginx }
- { jail: ingress, package: goaccess }
include_tasks: pkg_jail_install.yml
- name: Configure pf.conf
template:
src: ingress/etc_pf.conf.j2
dest: /usr/local/jails/containers/ingress/etc/pf.conf
owner: root
group: wheel
mode: "0644"
register: ingress_pf_conf
- name: Reload pf.conf
shell: jexec ingress pfctl -f /etc/pf.conf
when: ingress_pf_conf.changed
- name: Check if gateway mode is enabled
shell: jexec ingress sysrc gateway_enable | grep -q "YES"
register: ingress_gateway_enabled
failed_when: false
changed_when: false
- name: Enable gateway mode
shell: jexec ingress sysrc gateway_enable=YES
when: ingress_gateway_enabled.rc != 0
- name: Check if IP forwarding is enabled
shell: jexec ingress sysctl net.inet.ip.forwarding | grep -q "1"
register: ingress_ip_forwarding_enabled
failed_when: false
changed_when: false
- name: Enable IP forwarding
shell: jexec ingress sysctl net.inet.ip.forwarding=1
when: ingress_ip_forwarding_enabled.rc != 0
- name: Check if pf enabled
shell: jexec ingress sysrc pf_enable | grep -q "YES"
register: ingress_pf_enabled
failed_when: false
changed_when: false
- name: Enable pf
shell: jexec ingress sysrc pf_enable=YES
when: ingress_pf_enabled.rc != 0
- name: Check if pf is running
shell: service -j ingress pf status
register: ingress_pf_status
changed_when: ingress_pf_status.rc != 0
- name: Start pf
shell: service -j ingress pf start
when: ingress_pf_status.rc != 0
- name: Copy acme-dns-auth.py
copy:
src: templates/ingress/acme-dns-auth.py
dest: /usr/local/jails/containers/ingress/usr/local/bin/acme-dns-auth.py
owner: root
group: wheel
mode: "0755"
- name: Check if LetsEncrypt certs are generated
shell: ls /usr/local/jails/containers/ingress/usr/local/etc/letsencrypt/live/{{ cert_name }}
register: cert_exists
failed_when: false
changed_when: false
- name: Manually get certs with certbot and DNS challenge
pause:
prompt: |
/usr/local/etc/letsencrypt/live/{{ cert_name }} does not exist. This means that this is the first run of this playbook.
The {{ cert_name }} cert contains all of the @ and * certs for all domains.
Check the ingress crontab template and run the certbot command manually in the ingress jail. Remove the "-n" flag.
Add the requested DNS records manually into Hetzner DNS. Continue after this is done.
when: cert_exists.rc != 0
- name: Configure nginx.conf
template:
src: ingress/usr_local_etc_nginx_nginx.conf.j2
dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
owner: root
group: wheel
mode: "0644"
register: nginx_conf
- name: Create static directories
loop: "{{ ingress_routes | selectattr('static', 'defined') | map(attribute='static') | unique | list }}"
file:
path: "/usr/local/jails/containers/ingress{{ item }}"
state: directory
recurse: yes
owner: 80
group: 80
mode: "0755"
- name: Check if nginx is enabled
shell: service -j ingress nginx status
changed_when: false
failed_when: false
register: ingress_nginx_enabled
- name: Enable and start nginx
shell: |
service -j ingress nginx enable
service -j ingress nginx onestart
when: ingress_nginx_enabled.rc != 0 or nginx_conf.changed
- name: Install hetzner_ddns.sh
template:
src: ingress/usr_local_bin_hetzner_ddns.sh.j2
dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh
owner: root
group: wheel
mode: "0755"
- name: Set up hetzner_auth
template:
src: ingress/usr_local_etc_hetzner_auth.j2
dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth
owner: root
group: wheel
mode: "0600"
- name: Set up gen_goaccess.sh
template:
src: ingress/usr_local_bin_gen_goaccess.sh.j2
dest: /usr/local/jails/containers/ingress/usr/local/bin/gen_goaccess.sh
owner: root
group: wheel
mode: "0755"
- name: Set up crontab
template:
src: ingress/etc_crontab.j2
dest: /usr/local/jails/containers/ingress/etc/crontab
owner: root
group: wheel
mode: "0644"
vars:
tls_hosts: "{{ ingress_routes | map(attribute='host') | unique }}"
register: jail_ingress_etc_crontab
- name: Restart cron
service:
name: cron
state: restarted
when: jail_ingress_etc_crontab.changed
|
