Letsencrypt ansible module

####---------------------------------- Tasks  --------------------####





##### Nginx #####


[ec2-user@ip-172-31-10-148 nginx-project]$ tree
.
├── ansible.cfg
├── aws.pem
├── inventory
├── lineinfile.yml
├── main.yml
└── roles
    └── nginx
        ├── defaults
        │   └── main.yml
        ├── files
        ├── handlers
        │   └── main.yml
        ├── meta
        │   └── main.yml
        ├── README.md
        ├── tasks
        │   └── main.yml
        ├── templates
        │   └── nginx.conf.tmpl
        ├── tests
        │   ├── inventory
        │   └── test.yml
        └── vars
            └── main.yml




#### Role task ###

---
# tasks file for nginx

- name: "Installing nginx on remote server"
  yum:
    name: "{{ packages }}"
    state: present
- name: "Checking the status of the file"
  stat:
    path: "/etc/nginx/conf.d/{{ domain_name }}.conf"
  register: nginx_conf

- name: "Creating an nginx conf for the domain {{ domain_name }}"
  when: nginx_conf.stat.exists == false
  template:
    src: nginx.conf.tmpl
    dest: "/etc/nginx/conf.d/{{ domain_name }}.conf"
  notify:
    - restart-nginx
    - restart-php


#### nginx.conf.tmpl ####

[ec2-user@ip-172-31-10-148 nginx-project]$ cat roles/nginx/templates/nginx.conf.tmpl
server{
    server_name {{ domain_name }};
    listen 80;
    listen [::]:80;

    root /var/www/html/{{ domain_name }};
    index index.php;
    error_page  404  /404.html;

    add_header X-FRAME-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";


    location / {
        try_files $uri $uri/ /index.php?query_string;
    }


    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/var/run/php-fpm/www.sock;
    }

    location ~ /\.ht {
        deny all;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }

    location ~* \.(?:jpg|jpeg|gif|css|png|ico|svg|html)$ {
        access_log off;
        expires max;
    }


    gzip on;
    gzip_proxied no-cache no-store private expired auth;
}



#### Main playbook ####


---

- name: "Uploading the git PHP website using nginx role"
  hosts: test
  become: true
  roles:
    - nginx
  vars:
    git_url: "https://github.com/Chris-luiz-16/aws-elb-site.git"
    ssl_dir: /etc/nginx/ssl
    acme_directory: "https://acme-v02.api.letsencrypt.org/directory"
  tasks:
    - name: "Uploading the git contents to the remote server"
      git:
        repo: "{{ git_url }}"
        dest: /tmp/website
      register: git_status
    - name: "Copying the contents to the default document root /var/www/html/{{ domain_name }}"
      when: git_status.changed == true
      copy:
        src: /tmp/website/
        dest: "/var/www/html/{{ domain_name }}/"
        owner: "{{ nginx_owner }}"
        group: "{{ nginx_owner }}"
        remote_src: true
      notify:
        - restart-php
    - name: "Nginx restart required for Letsencrypt validation"
      service:
        name: nginx
        state: restarted
    - name: "Create a letsencrypt directory for nginx"
      file:
        path: "{{ ssl_dir }}/{{ item }}"
        state: directory
      with_items:
        - account
        - certs
        - csrs
        - keys
    - name: "Generate a account key for acme_module"
      community.crypto.openssl_privatekey:
        path: "{{ ssl_dir }}/account/account.key"
        type: RSA
        size: 4096
    - name: "Generate a private key for {{ domain_name }}"
      community.crypto.openssl_privatekey:
        path: "{{ ssl_dir }}/keys/{{ domain_name }}.key"
        type: RSA
        size: 4096
    - name: "Generate an csr with the common_name as {{ domain_name }}"
      community.crypto.openssl_csr:
        path: "{{ ssl_dir }}/csrs/{{ domain_name }}.csr"
        privatekey_path: "{{ ssl_dir }}/keys/{{ domain_name }}.key"
        common_name: "{{ domain_name }}"
    - name: "First challenge for {{ domain_name }} using the csr and account key"
      community.crypto.acme_certificate:
        acme_directory: "{{ acme_directory }}"
        acme_version: "2"
        account_key_src: "{{ ssl_dir }}/account/account.key"
        account_email: "admin@{{ domain_name }}"
        terms_agreed: true
        challenge: http-01
        csr: "{{ ssl_dir }}/csrs/{{ domain_name }}.csr"
        dest: "{{ ssl_dir }}/certs/{{ domain_name }}.crt"
        fullchain_dest: "{{ ssl_dir }}/certs/fullchain_{{ domain_name }}.crt"
      register: sample_com_challenge
    - name: "Create .well-known/acme-challenge directory"
      file:
        path: "/var/www/html/{{ domain_name }}/.well-known/acme-challenge"
        state: directory
        owner: "{{ nginx_owner }}"
        group: "{{ nginx_owner }}"
    - name: "Copy http-01 challenges to well-known/acme-challenge directory"
      copy:
        dest: "/var/www/html/{{ item.key }}/{{ item.value['http-01']['resource'] }}"
        content: "{{ item.value['http-01']['resource_value'] }}"
        owner: "{{ nginx_owner }}"
        group: "{{ nginx_owner }}"
      loop: "{{ sample_com_challenge.challenge_data | dict2items }}"
      when: sample_com_challenge is changed
    - name: "Final letsencrypt verification and saving the full chain file "
      community.crypto.acme_certificate:
        acme_directory: "{{ acme_directory }}"
        acme_version: "2"
        account_key_src: "{{ ssl_dir }}/account/account.key"
        account_email: "admin@{{ domain_name }}"
        terms_agreed: true
        challenge: http-01
        csr: "{{ ssl_dir }}/csrs/{{ domain_name }}.csr"
        dest: "{{ ssl_dir }}/certs/{{ domain_name }}.crt"
        fullchain_dest: "{{ ssl_dir }}/certs/fullchain_{{ domain_name }}.crt"
        data: "{{ sample_com_challenge }}"
      notify:
        - restart-nginx
    - name: "Activate SSL in nginx conf"
      blockinfile:
        path: "/etc/nginx/conf.d/{{ domain_name }}.conf"
        marker: "##<!-- {mark} ANSIBLE MANAGED BLOCK -->"
        insertafter: "root /var/www/html/{{ domain_name }};"
        block: |
          listen 443 ssl;
          ssl_certificate {{ ssl_dir }}/certs/fullchain_{{ domain_name }}.crt;
          ssl_certificate_key {{ ssl_dir }}/keys/{{ domain_name }}.key;
          if ($scheme = http) {
          return 301 https://$server_name$request_uri;
          }
      notify:
        - restart-nginx





#### output ####

[ec2-user@ip-172-31-10-148 nginx-project]$ ansible-playbook -i inventory main.yml -e domain_name=amazon.chrisich.fun

PLAY [Uploading the git PHP website using nginx role] ******************************************************************

TASK [Gathering Facts] *************************************************************************************************
ok: [flipkart]

TASK [nginx : Installing nginx on remote server] ***********************************************************************
changed: [flipkart]

TASK [nginx : Checking the status of the file] *************************************************************************
ok: [flipkart]

TASK [nginx : Creating an nginx conf for the domain amazon.chrisich.fun] ***********************************************
changed: [flipkart]

TASK [Uploading the git contents to the remote server] *****************************************************************
changed: [flipkart]

TASK [Copying the contents to the default document root /var/www/html/amazon.chrisich.fun] *****************************
changed: [flipkart]

TASK [Nginx restart required for Letsencrypt validation] ***************************************************************
changed: [flipkart]

TASK [Create a letsencrypt directory for nginx] ************************************************************************
changed: [flipkart] => (item=account)
changed: [flipkart] => (item=certs)
changed: [flipkart] => (item=csrs)
changed: [flipkart] => (item=keys)

TASK [Generate a account key for acme_module] **************************************************************************
changed: [flipkart]

TASK [Generate a private key for amazon.chrisich.fun] ******************************************************************
changed: [flipkart]

TASK [Generate an csr with the common_name as amazon.chrisich.fun] *****************************************************
changed: [flipkart]

TASK [First challenge for amazon.chrisich.fun using the csr and account key] *******************************************
changed: [flipkart]

TASK [Create .well-known/acme-challenge directory] *********************************************************************
changed: [flipkart]

TASK [Copy http-01 challenges to well-known/acme-challenge directory] **************************************************
changed: [flipkart] => (item={'key': 'amazon.chrisich.fun', 'value': {'http-01': {'resource': '.well-known/acme-challenge/QGJhTKgo1l24mU90Yp9AxS8YXkcrsef5hlcs_3S38PQ', 'resource_value': 'QGJhTKgo1l24mU90Yp9AxS8YXkcrsef5hlcs_3S38PQ.L7w-ZFUMVg7AGgX_5zNb9YlVJ1hpYMhnCrvqH4Zcq08'}, 'dns-01': {'resource': '_acme-challenge', 'resource_value': 'zITvzTMImB8TcYaY8pleEO-Jr1BRwjbmxHV7kqL3AO8', 'record': '_acme-challenge.amazon.chrisich.fun'}, 'tls-alpn-01': {'resource': 'amazon.chrisich.fun', 'resource_original': 'dns:amazon.chrisich.fun', 'resource_value': 'zITvzTMImB8TcYaY8pleEO+Jr1BRwjbmxHV7kqL3AO8='}}})

TASK [Final letsencrypt verification and saving the full chain file] ***************************************************
changed: [flipkart]

TASK [Activate SSL in nginx conf] **************************************************************************************
changed: [flipkart]

RUNNING HANDLER [nginx : restart-nginx] ********************************************************************************
changed: [flipkart]

RUNNING HANDLER [nginx : restart-php] **********************************************************************************
changed: [flipkart]

PLAY RECAP *************************************************************************************************************
flipkart                   : ok=18   changed=16   unreachable=0    failed=0    skipped=0    rescued=0    ignored=0