ansible/xoxys.certbot
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

base: ansible:main
Branches Tags
ansible:main
ansible:docs
ansible:refactoring
..
compare: ansible:refactoring
Branches Tags
ansible:main
ansible:docs
ansible:refactoring

No commits in common. "main" and "refactoring" have entirely different histories.
main ... refactorin

34 changed files with 422 additions and 702 deletions
Show Stats Expand all files Collapse all files

67
.drone.jsonnet
View File

@ -8,36 +8,14 @@ local PipelineLinting = {
steps: [
{
name: 'ansible-later',
image: 'thegeeklab/ansible-later',
image: 'xoxys/ansible-later',
commands: [
'ansible-later',
],
},
{
name: 'python-format',
image: 'python:3.11',
environment: {
PY_COLORS: 1,
},
commands: [
'pip install -qq yapf',
'[ -z "$(find . -type f -name *.py)" ] || (yapf -rd ./)',
],
},
{
name: 'python-flake8',
image: 'python:3.11',
environment: {
PY_COLORS: 1,
},
commands: [
'pip install -qq flake8',
'flake8',
],
},
],
trigger: {
ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'],
},
};
@ -58,12 +36,14 @@ local PipelineDeployment(scenario='centos7') = {
steps: [
{
name: 'ansible-molecule',
image: 'thegeeklab/molecule:4',
image: 'xoxys/molecule:3',
environment: {
HCLOUD_TOKEN: { from_secret: 'hcloud_token' },
DO_API_KEY: { from_secret: 'do_api_key' },
MOLECULE_CUSTOM_MODULES_REPO: 'https://gitea.rknet.org/ansible/custom_modules',
MOLECULE_CUSTOM_FILTERS_REPO: 'https://gitea.rknet.org/ansible/custom_filters',
},
commands: [
'molecule test -s ' + scenario,
'molecule test -s' + scenario,
],
},
],
@ -71,7 +51,7 @@ local PipelineDeployment(scenario='centos7') = {
'linting',
],
trigger: {
ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
ref: ['refs/heads/master', 'refs/tags/**'],
},
};
@ -85,7 +65,7 @@ local PipelineDocumentation = {
steps: [
{
name: 'generate',
image: 'thegeeklab/ansible-doctor',
image: 'xoxys/ansible-doctor',
environment: {
ANSIBLE_DOCTOR_LOG_LEVEL: 'INFO',
ANSIBLE_DOCTOR_FORCE_OVERWRITE: true,
@ -107,16 +87,31 @@ local PipelineDocumentation = {
target_branch: 'docs',
},
when: {
ref: ['refs/heads/main'],
ref: ['refs/heads/master'],
},
},
{
name: 'trigger',
image: 'plugins/downstream',
settings: {
server: 'https://drone.rknet.org',
token: { from_secret: 'drone_token' },
fork: true,
repositories: [
'ansible/ansible-galaxy',
],
},
when: {
ref: ['refs/heads/master'],
},
},
],
trigger: {
ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'],
},
depends_on: [
'testing-centos7',
'testing-rocky8',
'testing-centos8',
],
};
@ -133,11 +128,11 @@ local PipelineNotification = {
steps: [
{
name: 'matrix',
image: 'thegeeklab/drone-matrix',
image: 'plugins/matrix',
settings: {
homeserver: { from_secret: 'matrix_homeserver' },
roomid: { from_secret: 'matrix_roomid' },
template: 'Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}',
template: 'Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}',
username: { from_secret: 'matrix_username' },
password: { from_secret: 'matrix_password' },
},
@ -148,14 +143,14 @@ local PipelineNotification = {
],
trigger: {
status: ['success', 'failure'],
ref: ['refs/heads/main', 'refs/tags/**'],
ref: ['refs/heads/master', 'refs/tags/**'],
},
};
[
PipelineLinting,
PipelineDeployment(scenario='centos7'),
PipelineDeployment(scenario='rocky8'),
PipelineDeployment(scenario='centos8'),
PipelineDocumentation,
PipelineNotification,
]

110
.drone.yml
View File

@ -7,30 +7,14 @@ platform:
arch: amd64
steps:
- name: ansible-later
image: thegeeklab/ansible-later
- name: ansible-later
image: xoxys/ansible-later
commands:
- ansible-later
- name: python-format
image: python:3.11
commands:
- pip install -qq yapf
- "[ -z \"$(find . -type f -name *.py)\" ] || (yapf -rd ./)"
environment:
PY_COLORS: 1
- name: python-flake8
image: python:3.11
commands:
- pip install -qq flake8
- flake8
environment:
PY_COLORS: 1
trigger:
ref:
- refs/heads/main
- refs/heads/master
- refs/tags/**
- refs/pull/**
@ -50,55 +34,23 @@ workspace:
path: ${DRONE_REPO_NAME}
steps:
- name: ansible-molecule
image: thegeeklab/molecule:4
- name: ansible-molecule
image: xoxys/molecule:3
commands:
- molecule test -s centos7
- molecule test -scentos7
environment:
HCLOUD_TOKEN:
from_secret: hcloud_token
DO_API_KEY:
from_secret: do_api_key
MOLECULE_CUSTOM_FILTERS_REPO: https://gitea.rknet.org/ansible/custom_filters
MOLECULE_CUSTOM_MODULES_REPO: https://gitea.rknet.org/ansible/custom_modules
trigger:
ref:
- refs/heads/main
- refs/heads/master
- refs/tags/**
- refs/pull/**
depends_on:
- linting
---
kind: pipeline
name: testing-rocky8
platform:
os: linux
arch: amd64
concurrency:
limit: 1
workspace:
base: /drone/src
path: ${DRONE_REPO_NAME}
steps:
- name: ansible-molecule
image: thegeeklab/molecule:4
commands:
- molecule test -s rocky8
environment:
HCLOUD_TOKEN:
from_secret: hcloud_token
trigger:
ref:
- refs/heads/main
- refs/tags/**
- refs/pull/**
depends_on:
- linting
- linting
---
kind: pipeline
@ -109,8 +61,8 @@ platform:
arch: amd64
steps:
- name: generate
image: thegeeklab/ansible-doctor
- name: generate
image: xoxys/ansible-doctor
environment:
ANSIBLE_DOCTOR_EXCLUDE_FILES: molecule/
ANSIBLE_DOCTOR_FORCE_OVERWRITE: true
@ -119,7 +71,7 @@ steps:
ANSIBLE_DOCTOR_ROLE_NAME: ${DRONE_REPO_NAME#*.}
ANSIBLE_DOCTOR_TEMPLATE: hugo-book
- name: publish
- name: publish
image: plugins/gh-pages
settings:
netrc_machine: gitea.rknet.org
@ -132,17 +84,29 @@ steps:
from_secret: gitea_username
when:
ref:
- refs/heads/main
- refs/heads/master
- name: trigger
image: plugins/downstream
settings:
fork: true
repositories:
- ansible/ansible-galaxy
server: https://drone.rknet.org
token:
from_secret: drone_token
when:
ref:
- refs/heads/master
trigger:
ref:
- refs/heads/main
- refs/heads/master
- refs/tags/**
- refs/pull/**
depends_on:
- testing-centos7
- testing-rocky8
- testing-centos7
---
kind: pipeline
@ -156,8 +120,8 @@ clone:
disable: true
steps:
- name: matrix
image: thegeeklab/drone-matrix
- name: matrix
image: plugins/matrix
settings:
homeserver:
from_secret: matrix_homeserver
@ -165,23 +129,23 @@ steps:
from_secret: matrix_password
roomid:
from_secret: matrix_roomid
template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}"
username:
from_secret: matrix_username
trigger:
ref:
- refs/heads/main
- refs/heads/master
- refs/tags/**
status:
- success
- failure
depends_on:
- documentation
- documentation
---
kind: signature
hmac: 6048ef83a64bc78c4f6c2cb20f3a5fabe27eef22e1195f8288c8376372dd9c0a
hmac: c3eb21e904a1ceed464b6d86c674b7c0b6569ba1787b20cc716269ba7baf01b8
...

5
.flake8 Normal file
View File

@ -0,0 +1,5 @@
[flake8]
ignore = D101, D102, D103, D105, D107, E402, W503
max-line-length = 99
inline-quotes = double
exclude = .git,.tox,__pycache__,build,dist,tests,*.pyc,*.egg-info,.cache,.eggs,env*

2
.gitignore vendored
View File

@ -9,5 +9,3 @@ __pycache__/
*.py[cod]
*$py.class
# ---> Docs
/_docs

5
.later.yml
View File

@ -3,10 +3,9 @@ ansible:
custom_modules:
- iptables_raw
- openssl_pkcs12
- proxmox_kvm
- proxmox_kvm2
- ucr
- corenetworks_dns
- corenetworks_token
- yum_versionlock
rules:
exclude_files:

2
LICENSE
View File

@ -1,6 +1,6 @@
MIT License
Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
Copyright (c) 2020 Robert Kaussow <mail@geeklabor.de>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal

4
README.md
View File

@ -10,3 +10,7 @@ You can find the full documentation at [https://galaxy.geekdocs.de](https://gala
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
## Maintainers and Contributors
[Robert Kaussow](https://gitea.rknet.org/xoxys)

32
defaults/main.yml
View File

@ -1,31 +1,19 @@
---
# @var certbot_version:description: Set a fix version of the certbot package to install.
# @var certbot_version: $ "_unset_"
# @var certbot_packages_extra:description: Extra packages to install with pip (e.g. DNS plugins).
certbot_packages_extra: []
certbot_virtualenv_command: /usr/bin/python3 -m venv
certbot_virtualenv: /opt/python3/certbot
certbot_user: root
certbot_initial_run_enabled: False
certbot_work_dir: /var/lib/letsencrypt
certbot_config_dir: /etc/letsencrypt
certbot_log_dir: /var/log/letsencrypt
certbot_max_log_backups: 30
certbot_preferred_challenges: dns
certbot_server: https://acme-v02.api.letsencrypt.org/directory
certbot_email: mail@example.com
certbot_rsa_key_size: 4096
certbot_domain_groups:
- name: example
domains:
- "*.example.com"
certbot_domains:
- example.com
init: False
# @var certbot_credentials:description: >
# Specify key value parairs for your credentials (e.g. plugin credentials).
@ -34,18 +22,18 @@ certbot_domain_groups:
# @end
certbot_credentials: []
# @var certbot_bin:description: Location of the certbot binary. Default is to `~/.local/.bin/certbot`.
certbot_command_arguments:
- "certonly"
- "-n -d {{ certbot_domains | join(',') }}"
# @var certbot_cron_enabled:description: Enable scheduling via cron.
certbot_cron_enabled: True
# @var certbot_scheduler_enabled:description: Enable scheduling via cron.
certbot_scheduler_enabled: True
# @var certbot_cron_file:description: >
# Use a file under /etc/cron.d but this will only work if `certbot_user` has write permissions for this location.
certbot_cron_minute: 30
certbot_cron_hour: 3
# @var certbot_cron_file:description: Use a file under /etc/cron.d but this will only work if `certbot_user`
# has write permissions for this location.
# @end
# @var certbot_cron_file: $ "_unset_"
# @var certbot_cron_file:example: certbot-letsencrypt
certbot_cron_minute: "30"
certbot_cron_hour: "3"

26
meta/main.yml
View File

@ -1,20 +1,18 @@
# Standards: 0.2
# Standards: 0.1
---
galaxy_info:
# @meta author:value: [Robert Kaussow](https://gitea.rknet.org/xoxys)
author: Robert Kaussow <mail@thegeeklab.de>
namespace: xoxys
role_name: certbot
# @meta description: >
# [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.certbot)
# [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.certbot?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.certbot)
# [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/ansible/xoxys.certbot/src/branch/main/LICENSE)
#
# Setup [certbot](https://certbot.eff.org/) Let's Encrypt client.
# @end
# @meta author:value: [Robert Kaussow](https://gitea.rknet.org/xoxys)
author: Robert Kaussow <mail@geeklabor.de>
# @meta description: >
# [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.certbot)
# [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.certbot?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.certbot)
# [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
#
# Setup [certbot](https://certbot.eff.org/) Let's Encrypt client.
# @end
description: Setup certbot Let's Encrypt client
license: MIT
min_ansible_version: 2.10
min_ansible_version: 2.8
platforms:
- name: EL
versions:
@ -24,5 +22,3 @@ galaxy_info:
- letsencrypt
- certbot
dependencies: []
collections:
- community.general

5
molecule/centos7/converge.yml
View File

@ -2,9 +2,8 @@
- name: Converge
hosts: all
vars:
python3_packages_extra:
- centos-release-scl
certbot_packages_extra:
- epel-release
roles:
- role: xoxys.python3
- role: xoxys.certbot

101
molecule/centos7/create.yml
View File

@ -5,39 +5,36 @@
gather_facts: false
no_log: "{{ molecule_no_log }}"
vars:
ssh_port: 22
ssh_user: root
ssh_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key"
ssh_port: 22
keypair_name: molecule_key
keypair_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key"
tasks:
- name: Create SSH key
- name: Create local keypair
user:
name: "{{ lookup('env', 'USER') }}"
generate_ssh_key: true
ssh_key_file: "{{ ssh_path }}"
force: true
register: generated_ssh_key
ssh_key_file: "{{ keypair_path }}"
register: local_keypair
- name: Register the SSH key name
set_fact:
ssh_key_name: "molecule-generated-{{ 12345 | random | to_uuid }}"
- name: Register SSH key for test instance(s)
hcloud_ssh_key:
name: "{{ ssh_key_name }}"
public_key: "{{ generated_ssh_key.ssh_public_key }}"
- name: Create remote keypair
digital_ocean_sshkey:
name: "{{ keypair_name }}"
ssh_pub_key: "{{ local_keypair.ssh_public_key }}"
state: present
register: remote_keypair
- name: Create molecule instance(s)
hcloud_server:
digital_ocean_droplet:
name: "{{ item.name }}"
server_type: "{{ item.server_type }}"
ssh_keys:
- "{{ ssh_key_name }}"
image: "{{ item.image }}"
location: "{{ item.location | default(omit) }}"
datacenter: "{{ item.datacenter | default(omit) }}"
user_data: "{{ item.user_data | default(omit) }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
unique_name: true
region: "{{ item.region_id }}"
image: "{{ item.image_id }}"
size: "{{ item.size_id }}"
ssh_keys: "{{ remote_keypair.data.ssh_key.id }}"
wait: true
wait_timeout: 300
state: present
register: server
loop: "{{ molecule_yml.platforms }}"
@ -47,49 +44,25 @@
- name: Wait for instance(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_jobs
until: hetzner_jobs.finished
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
- name: Create volume(s)
hcloud_volume:
name: "{{ item.name }}"
server: "{{ item.name }}"
location: "{{ item.location | default(omit) }}"
size: "{{ item.volume_size | default(10) }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
state: "present"
loop: "{{ molecule_yml.platforms }}"
when: item.volume | default(False) | bool
register: volumes
async: 7200
poll: 0
- name: Wait for volume(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_volumes
until: hetzner_volumes.finished
retries: 300
when: volumes.changed
loop: "{{ volumes.results }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config dict
set_fact:
instance_conf_dict:
{
"instance": "{{ item.hcloud_server.name }}",
"ssh_key_name": "{{ ssh_key_name }}",
"address": "{{ item.hcloud_server.ipv4_address }}",
"user": "{{ ssh_user }}",
"port": "{{ ssh_port }}",
"identity_file": "{{ ssh_path }}",
"volume": "{{ item.item.item.volume | default(False) | bool }}",
instance_conf_dict: {
'instance': "{{ item.data.droplet.name }}",
'address': "{{ item.data.ip_address }}",
'user': "{{ ssh_user }}",
'port': "{{ ssh_port }}",
'identity_file': "{{ keypair_path }}",
'droplet_id': "{{ item.data.droplet.id }}",
'ssh_key_id': "{{ remote_keypair.data.ssh_key.id }}",
}
loop: "{{ hetzner_jobs.results }}"
loop: "{{ digitalocean_jobs.results }}"
register: instance_config_dict
when: server.changed | bool
@ -100,10 +73,7 @@
- name: Dump instance config
copy:
content: |
# Molecule managed
{{ instance_conf | to_nice_yaml(indent=2) }}
content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool
@ -113,8 +83,5 @@
host: "{{ item.address }}"
search_regex: SSH
delay: 10
loop: "{{ lookup('file', molecule_instance_config) | from_yaml }}"
- name: Wait for VM to settle down
pause:
seconds: 30
timeout: 320
loop: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"

64
molecule/centos7/destroy.yml
View File

@ -5,62 +5,41 @@
gather_facts: false
no_log: "{{ molecule_no_log }}"
tasks:
- name: Check existing instance config file
stat:
path: "{{ molecule_instance_config }}"
register: cfg
- name: Populate the instance config
- block:
- name: Populate instance config
set_fact:
instance_conf: "{{ (lookup('file', molecule_instance_config) | from_yaml) if cfg.stat.exists else [] }}"
instance_conf: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"
skip_instances: false
rescue:
- name: Populate instance config when file missing
set_fact:
instance_conf: {}
skip_instances: true
- name: Destroy molecule instance(s)
hcloud_server:
digital_ocean_droplet:
name: "{{ item.instance }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
id: "{{ item.droplet_id }}"
state: absent
register: server
loop: "{{ instance_conf }}"
loop: "{{ instance_conf | flatten(levels=1) }}"
when: not skip_instances
async: 7200
poll: 0
- name: Wait for instance(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_jobs
until: hetzner_jobs.finished
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
- pause:
seconds: 5
- name: Destroy volume(s)
hcloud_volume:
name: "{{ item.instance }}"
server: "{{ item.instance }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
state: "absent"
register: volumes
loop: "{{ instance_conf }}"
when: item.volume | default(False) | bool
async: 7200
poll: 0
- name: Wait for volume(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_volumes
until: hetzner_volumes.finished
retries: 300
when: volumes.changed
loop: "{{ volumes.results }}"
- name: Remove registered SSH key
hcloud_ssh_key:
name: "{{ instance_conf[0].ssh_key_name }}"
- name: Delete remote keypair
digital_ocean_sshkey:
fingerprint: "{{ item.ssh_key_id }}"
state: absent
when: (instance_conf | default([])) | length > 0
loop: "{{ instance_conf | flatten(levels=1) }}"
# Mandatory configuration for Molecule to function.
@ -70,9 +49,6 @@
- name: Dump instance config
copy:
content: |
# Molecule managed
{{ instance_conf | to_nice_yaml(indent=2) }}
content: "{{ instance_conf | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool

13
molecule/centos7/molecule.yml
View File

@ -1,24 +1,19 @@
---
dependency:
name: galaxy
options:
role-file: molecule/requirements.yml
requirements-file: molecule/requirements.yml
env:
ANSIBLE_GALAXY_DISPLAY_PROGRESS: "false"
driver:
name: delegated
platforms:
- name: centos7-certbot
image: centos-7
server_type: cx11
region_id: fra1
image_id: centos-7-x64
size_id: s-1vcpu-1gb
lint: |
/usr/local/bin/flake8
flake8
provisioner:
name: ansible
env:
ANSIBLE_FILTER_PLUGINS: ${ANSIBLE_FILTER_PLUGINS:-./plugins/filter}
ANSIBLE_LIBRARY: ${ANSIBLE_LIBRARY:-./library}
log: False
verifier:
name: testinfra

10
molecule/centos7/prepare.yml
View File

@ -3,13 +3,7 @@
hosts: all
gather_facts: false
tasks:
- name: Bootstrap python for Ansible
raw: |
command -v python3 python || (
(test -e /usr/bin/dnf && sudo dnf install -y python3) ||
(test -e /usr/bin/apt && (apt -y update && apt install -y python-minimal)) ||
(test -e /usr/bin/yum && sudo yum -y -qq install python3) ||
echo "Warning: Python not boostrapped due to unknown platform."
)
- name: Install python for Ansible
raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)
become: true
changed_when: false

16
molecule/centos7/tests/test_default.py
View File

@ -2,17 +2,13 @@ import os
import testinfra.utils.ansible_runner
import warnings
warnings.filterwarnings("ignore", category=DeprecationWarning)
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ["MOLECULE_INVENTORY_FILE"]
).get_hosts("all")
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_certbot_is_installed(host):
pkg = host.pip_package.get_packages(pip_path="/opt/python3/certbot/bin/pip")
assert "certbot" in pkg
def test_certbot_run(host):
cmd = host.run("/usr/local/bin/certbot --help")
assert "Certbot can obtain and install HTTPS/TLS/SSL certificates." in cmd.stdout
assert cmd.succeeded
certbot = host.package("certbot")
assert certbot.is_installed

5
molecule/rocky8/converge.yml → molecule/centos8/converge.yml
View File

@ -1,6 +1,9 @@
---
- name: Converge
hosts: all
vars:
certbot_packages_extra:
- epel-release
roles:
- role: xoxys.python3
- role: xoxys.certbot

87
molecule/centos8/create.yml Normal file
View File

@ -0,0 +1,87 @@
---
- name: Create
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
vars:
ssh_user: root
ssh_port: 22
keypair_name: molecule_key
keypair_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key"
tasks:
- name: Create local keypair
user:
name: "{{ lookup('env', 'USER') }}"
generate_ssh_key: true
ssh_key_file: "{{ keypair_path }}"
register: local_keypair
- name: Create remote keypair
digital_ocean_sshkey:
name: "{{ keypair_name }}"
ssh_pub_key: "{{ local_keypair.ssh_public_key }}"
state: present
register: remote_keypair
- name: Create molecule instance(s)
digital_ocean_droplet:
name: "{{ item.name }}"
unique_name: true
region: "{{ item.region_id }}"
image: "{{ item.image_id }}"
size: "{{ item.size_id }}"
ssh_keys: "{{ remote_keypair.data.ssh_key.id }}"
wait: true
wait_timeout: 300
state: present
register: server
loop: "{{ molecule_yml.platforms }}"
async: 7200
poll: 0
- name: Wait for instance(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config dict
set_fact:
instance_conf_dict: {
'instance': "{{ item.data.droplet.name }}",
'address': "{{ item.data.ip_address }}",
'user': "{{ ssh_user }}",
'port': "{{ ssh_port }}",
'identity_file': "{{ keypair_path }}",
'droplet_id': "{{ item.data.droplet.id }}",
'ssh_key_id': "{{ remote_keypair.data.ssh_key.id }}",
}
loop: "{{ digitalocean_jobs.results }}"
register: instance_config_dict
when: server.changed | bool
- name: Convert instance config dict to a list
set_fact:
instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}"
when: server.changed | bool
- name: Dump instance config
copy:
content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool
- name: Wait for SSH
wait_for:
port: "{{ ssh_port }}"
host: "{{ item.address }}"
search_regex: SSH
delay: 10
timeout: 320
loop: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"

1
molecule/centos8/default Symbolic link
View File

@ -0,0 +1 @@
default

54
molecule/centos8/destroy.yml Normal file
View File

@ -0,0 +1,54 @@
---
- name: Destroy
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
tasks:
- block:
- name: Populate instance config
set_fact:
instance_conf: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"
skip_instances: false
rescue:
- name: Populate instance config when file missing
set_fact:
instance_conf: {}
skip_instances: true
- name: Destroy molecule instance(s)
digital_ocean_droplet:
name: "{{ item.instance }}"
id: "{{ item.droplet_id }}"
state: absent
register: server
loop: "{{ instance_conf | flatten(levels=1) }}"
when: not skip_instances
async: 7200
poll: 0
- name: Wait for instance(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
- name: Delete remote keypair
digital_ocean_sshkey:
fingerprint: "{{ item.ssh_key_id }}"
state: absent
loop: "{{ instance_conf | flatten(levels=1) }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config
set_fact:
instance_conf: {}
- name: Dump instance config
copy:
content: "{{ instance_conf | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool

15
molecule/rocky8/molecule.yml → molecule/centos8/molecule.yml
View File

@ -1,24 +1,19 @@
---
dependency:
name: galaxy
options:
role-file: molecule/requirements.yml
requirements-file: molecule/requirements.yml
env:
ANSIBLE_GALAXY_DISPLAY_PROGRESS: "false"
driver:
name: delegated
platforms:
- name: rocky8-certbot
image: rocky-8
server_type: cx11
- name: centos7-certbot
region_id: fra1
image_id: centos-8-x64
size_id: s-1vcpu-1gb
lint: |
/usr/local/bin/flake8
flake8
provisioner:
name: ansible
env:
ANSIBLE_FILTER_PLUGINS: ${ANSIBLE_FILTER_PLUGINS:-./plugins/filter}
ANSIBLE_LIBRARY: ${ANSIBLE_LIBRARY:-./library}
log: False
verifier:
name: testinfra

9
molecule/centos8/prepare.yml Normal file
View File

@ -0,0 +1,9 @@
---
- name: Prepare
hosts: all
gather_facts: false
tasks:
- name: Install python for Ansible
raw: test -e /usr/bin/python || (dnf -y install python3 && alternatives --set python /usr/bin/python3)
become: true
changed_when: false

14
molecule/centos8/tests/test_default.py Normal file
View File

@ -0,0 +1,14 @@
import os
import testinfra.utils.ansible_runner
import warnings
warnings.filterwarnings("ignore", category=DeprecationWarning)
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_certbot_is_installed(host):
certbot = host.package("certbot")
assert certbot.is_installed

2
molecule/default
View File

@ -1 +1 @@
rocky8
centos8

10
molecule/requirements.yml
View File

@ -1,10 +0,0 @@
---
collections:
- name: https://gitea.rknet.org/ansible/xoxys.general/releases/download/v2.1.1/xoxys-general-2.1.1.tar.gz
- name: community.general
roles:
- src: https://gitea.rknet.org/ansible/xoxys.python3.git
name: xoxys.python3
scm: git
version: main

120
molecule/rocky8/create.yml
View File

@ -1,120 +0,0 @@
---
- name: Create
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
vars:
ssh_port: 22
ssh_user: root
ssh_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key"
tasks:
- name: Create SSH key
user:
name: "{{ lookup('env', 'USER') }}"
generate_ssh_key: true
ssh_key_file: "{{ ssh_path }}"
force: true
register: generated_ssh_key
- name: Register the SSH key name
set_fact:
ssh_key_name: "molecule-generated-{{ 12345 | random | to_uuid }}"
- name: Register SSH key for test instance(s)
hcloud_ssh_key:
name: "{{ ssh_key_name }}"
public_key: "{{ generated_ssh_key.ssh_public_key }}"
state: present
- name: Create molecule instance(s)
hcloud_server:
name: "{{ item.name }}"
server_type: "{{ item.server_type }}"
ssh_keys:
- "{{ ssh_key_name }}"
image: "{{ item.image }}"
location: "{{ item.location | default(omit) }}"
datacenter: "{{ item.datacenter | default(omit) }}"
user_data: "{{ item.user_data | default(omit) }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
state: present
register: server
loop: "{{ molecule_yml.platforms }}"
async: 7200
poll: 0
- name: Wait for instance(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_jobs
until: hetzner_jobs.finished
retries: 300
loop: "{{ server.results }}"
- name: Create volume(s)
hcloud_volume:
name: "{{ item.name }}"
server: "{{ item.name }}"
location: "{{ item.location | default(omit) }}"
size: "{{ item.volume_size | default(10) }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
state: "present"
loop: "{{ molecule_yml.platforms }}"
when: item.volume | default(False) | bool
register: volumes
async: 7200
poll: 0
- name: Wait for volume(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_volumes
until: hetzner_volumes.finished
retries: 300
when: volumes.changed
loop: "{{ volumes.results }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config dict
set_fact:
instance_conf_dict:
{
"instance": "{{ item.hcloud_server.name }}",
"ssh_key_name": "{{ ssh_key_name }}",
"address": "{{ item.hcloud_server.ipv4_address }}",
"user": "{{ ssh_user }}",
"port": "{{ ssh_port }}",
"identity_file": "{{ ssh_path }}",
"volume": "{{ item.item.item.volume | default(False) | bool }}",
}
loop: "{{ hetzner_jobs.results }}"
register: instance_config_dict
when: server.changed | bool
- name: Convert instance config dict to a list
set_fact:
instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}"
when: server.changed | bool
- name: Dump instance config
copy:
content: |
# Molecule managed
{{ instance_conf | to_nice_yaml(indent=2) }}
dest: "{{ molecule_instance_config }}"
when: server.changed | bool
- name: Wait for SSH
wait_for:
port: "{{ ssh_port }}"
host: "{{ item.address }}"
search_regex: SSH
delay: 10
loop: "{{ lookup('file', molecule_instance_config) | from_yaml }}"
- name: Wait for VM to settle down
pause:
seconds: 30

78
molecule/rocky8/destroy.yml
View File

@ -1,78 +0,0 @@
---
- name: Destroy
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
tasks:
- name: Check existing instance config file
stat:
path: "{{ molecule_instance_config }}"
register: cfg
- name: Populate the instance config
set_fact:
instance_conf: "{{ (lookup('file', molecule_instance_config) | from_yaml) if cfg.stat.exists else [] }}"
- name: Destroy molecule instance(s)
hcloud_server:
name: "{{ item.instance }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
state: absent
register: server
loop: "{{ instance_conf }}"
async: 7200
poll: 0
- name: Wait for instance(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_jobs
until: hetzner_jobs.finished
retries: 300
loop: "{{ server.results }}"
- pause:
seconds: 5
- name: Destroy volume(s)
hcloud_volume:
name: "{{ item.instance }}"
server: "{{ item.instance }}"
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
state: "absent"
register: volumes
loop: "{{ instance_conf }}"
when: item.volume | default(False) | bool
async: 7200
poll: 0
- name: Wait for volume(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: hetzner_volumes
until: hetzner_volumes.finished
retries: 300
when: volumes.changed
loop: "{{ volumes.results }}"
- name: Remove registered SSH key
hcloud_ssh_key:
name: "{{ instance_conf[0].ssh_key_name }}"
state: absent
when: (instance_conf | default([])) | length > 0
# Mandatory configuration for Molecule to function.
- name: Populate instance config
set_fact:
instance_conf: {}
- name: Dump instance config
copy:
content: |
# Molecule managed
{{ instance_conf | to_nice_yaml(indent=2) }}
dest: "{{ molecule_instance_config }}"
when: server.changed | bool

15
molecule/rocky8/prepare.yml
View File

@ -1,15 +0,0 @@
---
- name: Prepare
hosts: all
gather_facts: false
tasks:
- name: Bootstrap python for Ansible
raw: |
command -v python3 python || (
(test -e /usr/bin/dnf && sudo dnf install -y python3) ||
(test -e /usr/bin/apt && (apt -y update && apt install -y python-minimal)) ||
(test -e /usr/bin/yum && sudo yum -y -qq install python3) ||
echo "Warning: Python not boostrapped due to unknown platform."
)
become: true
changed_when: false

18
molecule/rocky8/tests/test_default.py
View File

@ -1,18 +0,0 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ["MOLECULE_INVENTORY_FILE"]
).get_hosts("all")
def test_certbot_is_installed(host):
pkg = host.pip_package.get_packages(pip_path="/opt/python3/certbot/bin/pip")
assert "certbot" in pkg
def test_certbot_run(host):
cmd = host.run("/usr/local/bin/certbot --help")
assert "Certbot can obtain and install HTTPS/TLS/SSL certificates." in cmd.stdout
assert cmd.succeeded

12
setup.cfg
View File

@ -1,12 +0,0 @@
[flake8]
ignore = D100, D101, D102, D103, D105, D107, E402, W503
max-line-length = 99
inline-quotes = double
exclude = .git,.tox,__pycache__,build,dist,tests,*.pyc,*.egg-info,.cache,.eggs,env*
[yapf]
based_on_style = google
column_limit = 99
dedent_closing_brackets = true
coalesce_brackets = true
split_before_logical_operator = true

78
tasks/install.yml
View File

@ -1,59 +1,17 @@
---
- name: Create certbot user '{{ certbot_user }}'
- block:
- name: Install certbot
package:
name: "{{ item }}"
state: present
loop: "{{ certbot_packages_extra + __certbot_packages }}"
- name: Create certbot user '{{ certbot_user }}'
user:
name: "{{ certbot_user }}"
become: True
become_user: root
when: not certbot_user == 'root'
- block:
- name: Upgrade python dependencies
pip:
name: "{{ item }}"
virtualenv: "{{ certbot_virtualenv }}"
virtualenv_command: "{{ certbot_virtualenv_command }}"
extra_args: --upgrade
loop:
- pip
- setuptools
- name: Install dependencies
pip:
name: "{{ item }}"
virtualenv: "{{ certbot_virtualenv }}"
virtualenv_command: "{{ certbot_virtualenv_command }}"
environment:
TMPDIR: /opt/python3/tmp
loop: "{{ certbot_packages_extra }}"
- name: Install certbot
pip:
name: "{{ item }}"
virtualenv: "{{ certbot_virtualenv }}"
virtualenv_command: "{{ certbot_virtualenv_command }}"
loop: "{{ __certbot_packages }}"
- name: Adjust file permissions
file:
name: "{{ certbot_virtualenv }}"
recurse: True
mode: u+rwX,go+rX,go-w
state: directory
- name: Make certbot binaries executable
file:
name: "{{ certbot_virtualenv }}/bin/{{ item }}"
mode: 0755
loop: "{{ __certbot_binaries }}"
- name: Deploy certbot bin wrappers
template:
src: usr/local/bin/certbot-wrapper.j2
dest: "/usr/local/bin/{{ item }}"
owner: root
group: root
mode: 0755
loop: "{{ __certbot_binaries }}"
become: True
become_user: root
@ -63,7 +21,7 @@
path: "{{ item.name }}"
state: directory
mode: "{{ item.mode }}"
loop: "{{ __certbot_environment }}"
loop: "{{ certbot_environment }}"
loop_control:
label: "{{ item.name }}"
@ -71,33 +29,27 @@
template:
src: config/cli.ini.j2
dest: "{{ certbot_config_dir }}/cli.ini"
mode: 0640
- name: Deploy credentials file
template:
src: config/credentials.ini.j2
dest: "{{ certbot_config_dir }}/credentials.ini"
mode: 0600
when: certbot_credentials | default([]) | length > 0
when: certbot_credentials
mode: 600
- name: Schedule certbot run
cron:
name: "Certbot automatic renewal: {{ item.name }}"
name: Certbot automatic renewal
minute: "{{ certbot_cron_minute }}"
hour: "{{ certbot_cron_hour }}"
user: "{{ certbot_cron_user | default(certbot_user) }}"
job: >
{{ certbot_bin | default(__certbot_bin) }}
certbot
--config-dir {{ certbot_config_dir }}
--work-dir {{ certbot_work_dir }}
--logs-dir {{ certbot_log_dir }}/{{ item.name }}
--max-log-backups {{ certbot_max_log_backups }}
--logs-dir {{ certbot_log_dir }}
{{ certbot_command_arguments | join(' ') }}
-n -d {{ item.domains | join(',') }}
cron_file: "{{ certbot_cron_file | default(omit) }}"
loop: "{{ certbot_domain_groups }}"
loop_control:
label: "{{ item.name }}"
when: certbot_cron_enabled
when: certbot_scheduler_enabled
become: True
become_user: "{{ certbot_user }}"

19
tasks/setup.yml
View File

@ -1,20 +1,17 @@
---
- name: Initial run of certbot
- name: Initialise certbot
block:
- name: Initial run of certbot
command: >
{{ certbot_bin | default(__certbot_bin) }}
certbot
--config-dir {{ certbot_config_dir }}
--work-dir {{ certbot_work_dir }}
--logs-dir {{ certbot_log_dir }}/{{ item.name }}
--max-log-backups {{ certbot_max_log_backups }}
--logs-dir {{ certbot_log_dir }}
--agree-tos
{{ certbot_command_arguments | join(' ') }}
-n -d {{ item.domains | join(',') }}
register: __certbot_init
changed_when: __certbot_init.rc == 130
register: certbot_init
changed_when: certbot_init.rc == 130
ignore_errors: True
loop: "{{ certbot_domain_groups }}"
loop_control:
label: "{{ item.name }}"
when: item.init | default(False) | bool
become: True
become_user: "{{ certbot_user }}"
when: certbot_initial_run_enabled

3
templates/config/credentials.ini.j2
View File

@ -1,3 +0,0 @@
{% for line in certbot_credentials %}
{{ line }}
{% endfor %}

4
templates/usr/local/bin/certbot-wrapper.j2
View File

@ -1,4 +0,0 @@
#!/usr/bin/env sh
set -eo pipefail
exec {{ certbot_virtualenv }}/bin/{{ item }} "$@"

16
vars/main.yml
View File

@ -1,16 +1,8 @@
---
__certbot_packages:
- "certbot{{ '==' + certbot_version if certbot_version is defined else '' }}"
__certbot_environment:
- name: "{{ certbot_work_dir }}"
mode: "0755"
- name: "{{ certbot_config_dir }}"
mode: "0755"
- name: "{{ certbot_log_dir }}"
mode: "0700"
__certbot_binaries:
- certbot
__certbot_bin: "/usr/local/bin/certbot"
__certbot_environment:
- { name: "{{ certbot_work_dir }}", mode: "0755" }
- { name: "{{ certbot_config_dir }}", mode: "0755" }
- { name: "{{ certbot_log_dir }}", mode: "0700" }