From 850275469f7da1a9829edfe45bd40b40d3cc6a02 Mon Sep 17 00:00:00 2001 From: Matthew Fennell Date: Wed, 15 May 2024 23:09:01 +0100 Subject: Delegate certificate management to acme project Although this playbook originally installed certificates to the server, this turned out to be a bad idea, because the playbook could in some circumstances (if the acme project had already renewed the certs) have installed a different certificate to the remote server. By delgating responsibility to the acme server fully, this should prevent any such issues, as well as potential DANE misconfigurations. --- playbook.yaml | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) (limited to 'playbook.yaml') diff --git a/playbook.yaml b/playbook.yaml index 5de4fea..06ebc59 100644 --- a/playbook.yaml +++ b/playbook.yaml @@ -59,7 +59,7 @@ -binary | hexdump -ve '/1 "%02x"' register: dane_hash changed_when: false - delegate_to: localhost + delegate_to: "{{ cert_host }}" # We allow status code 400 here as this is returned by deSEC if the domain # already exists. Ideally, we should filter out genuinely good/bad requests @@ -377,26 +377,6 @@ state: absent become: true - - name: Ensure prosody key is installed - ansible.builtin.copy: - src: "~/.lego/certificates/{{ virtual_host }}.key" - dest: "/etc/prosody/certs" - mode: "0640" - owner: root - group: prosody - become: true - notify: Restart prosody - - - name: Ensure prosody certificate is installed - ansible.builtin.copy: - src: "~/.lego/certificates/{{ virtual_host }}.crt" - dest: "/etc/prosody/certs" - mode: "0640" - owner: root - group: prosody - become: true - notify: Restart prosody - - name: Ensure prosody users are registered ansible.builtin.expect: command: "prosodyctl adduser {{ item.name }}@{{ virtual_host }}" -- cgit v1.2.3