hatecomputers.club stuff
This commit is contained in:
parent
d740b6ab33
commit
64a2990c53
@ -1,2 +1,3 @@
|
|||||||
---
|
---
|
||||||
letsencrypt_email: 'elizabeth.hunt@simponic.xyz'
|
letsencrypt_email: 'elizabeth@simponic.xyz'
|
||||||
|
hatecomputers_api_key: "{{ lookup('env', 'HATECOMPUTERS_API_KEY') }}"
|
||||||
|
@ -0,0 +1,13 @@
|
|||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name simponic.hatecomputers.club;
|
||||||
|
|
||||||
|
location /.well-known/acme-challenge {
|
||||||
|
root /var/www/letsencrypt;
|
||||||
|
try_files $uri $uri/ =404;
|
||||||
|
}
|
||||||
|
|
||||||
|
location / {
|
||||||
|
rewrite ^ https://simponic.hatecomputers.club$request_uri? permanent;
|
||||||
|
}
|
||||||
|
}
|
@ -0,0 +1,25 @@
|
|||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
server_name simponic.hatecomputers.club;
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/simponic.hatecomputers.club/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/simponic.hatecomputers.club/privkey.pem;
|
||||||
|
ssl_trusted_certificate /etc/letsencrypt/live/simponic.hatecomputers.club/fullchain.pem;
|
||||||
|
|
||||||
|
ssl_session_cache shared:SSL:50m;
|
||||||
|
ssl_session_timeout 5m;
|
||||||
|
ssl_stapling on;
|
||||||
|
ssl_stapling_verify on;
|
||||||
|
|
||||||
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||||
|
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
|
||||||
|
|
||||||
|
ssl_dhparam /etc/nginx/dhparams.pem;
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
|
||||||
|
root /var/www/html/static.simponic.xyz;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
try_files $uri $uri/ $uri.html =404;
|
||||||
|
}
|
||||||
|
}
|
@ -62,14 +62,43 @@
|
|||||||
loop: "{{ nginx_conf_files.files }}"
|
loop: "{{ nginx_conf_files.files }}"
|
||||||
register: extracted_domains
|
register: extracted_domains
|
||||||
|
|
||||||
- name: request letsencrypt certificate
|
# simponic.xyz
|
||||||
|
- name: request simponic letsencrypt certificates
|
||||||
shell: >
|
shell: >
|
||||||
letsencrypt certonly -n --webroot -w /var/www/letsencrypt -m {{ letsencrypt_email }} \
|
letsencrypt certonly -n --webroot -w /var/www/letsencrypt -m {{ letsencrypt_email }} \
|
||||||
--agree-tos -d {{ item.stdout }}
|
--agree-tos -d {{ item.stdout }}
|
||||||
args:
|
args:
|
||||||
creates: "/etc/letsencrypt/live/{{ item.stdout }}"
|
creates: "/etc/letsencrypt/live/{{ item.stdout }}"
|
||||||
loop: "{{ extracted_domains.results }}"
|
loop: "{{ extracted_domains.results }}"
|
||||||
when: item.stdout != ""
|
when: '"simponic.xyz" in item.stdout'
|
||||||
|
|
||||||
|
# hatecomputers.club
|
||||||
|
- name: build plugin template
|
||||||
|
template:
|
||||||
|
src: ../templates/plugin.sh.j2
|
||||||
|
dest: /etc/letsencrypt/hcdns.sh
|
||||||
|
mode: 0744
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
|
||||||
|
- name: clone hcdns auth repo
|
||||||
|
ansible.builtin.git:
|
||||||
|
repo: https://git.hatecomputers.club/simponic/hc-cert-dns
|
||||||
|
dest: /root/hc-cert-dns
|
||||||
|
|
||||||
|
- name: request hatecomputers letsencrypt certificate
|
||||||
|
shell: >
|
||||||
|
letsencrypt certonly -n \
|
||||||
|
--manual --manual-auth-hook /etc/letsencrypt/hcdns.sh \
|
||||||
|
--preferred-challenges dns \
|
||||||
|
-d {{ item.stdout }} \
|
||||||
|
--email {{ letsencrypt_email }} \
|
||||||
|
--agree-tos \
|
||||||
|
--no-eff-email
|
||||||
|
args:
|
||||||
|
creates: "/etc/letsencrypt/live/{{ item.stdout }}"
|
||||||
|
loop: "{{ extracted_domains.results }}"
|
||||||
|
when: '"hatecomputers.club" in item.stdout'
|
||||||
|
|
||||||
- name: copy https nginx configuration for each domain
|
- name: copy https nginx configuration for each domain
|
||||||
copy:
|
copy:
|
||||||
|
18
roles/webservers/templates/plugin.sh.j2
Normal file
18
roles/webservers/templates/plugin.sh.j2
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
unset REQUESTS_CA_BUNDLE
|
||||||
|
|
||||||
|
API_KEY_FILE=$(mktemp)
|
||||||
|
echo "{{ hatecomputers_api_key }}" >> $API_KEY_FILE
|
||||||
|
|
||||||
|
ENDPOINT=https://hatecomputers.club
|
||||||
|
PUBLIC_SUFFIXES=.hatecomputers.club
|
||||||
|
|
||||||
|
/root/hc-cert-dns/main.py --certbot \
|
||||||
|
--public-suffixes=$PUBLIC_SUFFIXES \
|
||||||
|
--certbot-domain=$CERTBOT_DOMAIN \
|
||||||
|
--certbot-validation=$CERTBOT_VALIDATION \
|
||||||
|
--endpoint=$ENDPOINT \
|
||||||
|
--api-key-file=$API_KEY_FILE
|
||||||
|
|
||||||
|
rm $API_KEY_FILE
|
Loading…
Reference in New Issue
Block a user