7d3adc4512
We do use some `:latest` images by default for the following services: - matrix-dimension - Goofys (in the matrix-synapse role) - matrix-bridge-appservice-irc - matrix-bridge-appservice-discord - matrix-bridge-mautrix-facebook - matrix-bridge-mautrix-whatsapp It's terribly unfortunate that those software projects don't release anything other than `:latest`, but that's how it is for now. Updating that software requires that users manually do `docker pull` on the server. The playbook didn't force-repull images that it already had. With this patch, it starts doing so. Any image tagged `:latest` will be force re-pulled by the playbook every time it's executed. It should be noted that even though we ask the `docker_image` module to force-pull, it only reports "changed" when it actually pulls something new. This is nice, because it lets people know exactly when something gets updated, as opposed to giving the indication that it's always updating the images (even though it isn't).
119 lines
4.4 KiB
YAML
119 lines
4.4 KiB
YAML
---
|
|
|
|
# This is a cleanup/migration task, because of to the new way we manage cronjobs (`cron` module) and the new script name.
|
|
# This migration task can be removed some time in the future.
|
|
- name: (Migration) Remove deprecated Let's Encrypt SSL certificate management files
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- /usr/local/bin/matrix-ssl-certificates-renew
|
|
- /etc/cron.d/matrix-ssl-certificate-renewal
|
|
- /etc/cron.d/matrix-nginx-proxy-periodic-restarter
|
|
|
|
|
|
#
|
|
# Tasks related to setting up Let's Encrypt's management of certificates
|
|
#
|
|
|
|
- name: (Deprecation) Catch and report renamed settings
|
|
fail:
|
|
msg: >-
|
|
Your configuration contains a variable, which now has a different name.
|
|
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
|
|
with_items:
|
|
- {'old': 'host_specific_matrix_ssl_support_email', 'new': 'matrix_ssl_lets_encrypt_support_email'}
|
|
- {'old': 'host_specific_matrix_ssl_lets_encrypt_support_email', 'new': 'matrix_ssl_lets_encrypt_support_email'}
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt' and item.old in vars"
|
|
|
|
- name: Fail if required variables are undefined
|
|
fail:
|
|
msg: "Detected an undefined required variable"
|
|
with_items:
|
|
- "matrix_ssl_lets_encrypt_support_email"
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt' and vars[item] is none"
|
|
|
|
- name: Ensure certbot Docker image is pulled
|
|
docker_image:
|
|
name: "{{ matrix_ssl_lets_encrypt_certbot_docker_image }}"
|
|
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
|
force_source: "{{ matrix_ssl_lets_encrypt_certbot_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
|
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_ssl_lets_encrypt_certbot_docker_image_force_pull }}"
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
- name: Obtain Let's Encrypt certificates
|
|
include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml"
|
|
with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for }}"
|
|
loop_control:
|
|
loop_var: domain_name
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
- name: Ensure Let's Encrypt SSL renewal script installed
|
|
template:
|
|
src: "{{ role_path }}/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2"
|
|
dest: /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew
|
|
mode: 0750
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
- block:
|
|
- name: Ensure periodic SSL renewal cronjob configured (MAILTO)
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
env: yes
|
|
name: MAILTO
|
|
value: "{{ matrix_ssl_lets_encrypt_support_email }}"
|
|
|
|
- name: Ensure periodic SSL renewal cronjob configured (matrix-ssl-lets-encrypt-certificates-renew)
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
name: matrix-ssl-lets-encrypt-certificates-renew
|
|
state: present
|
|
hour: "4"
|
|
minute: "15"
|
|
day: "*"
|
|
job: /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew
|
|
|
|
- name: Ensure periodic reloading of matrix-nginx-proxy is configured for SSL renewal (matrix-nginx-proxy-reload)
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
name: matrix-nginx-proxy-reload
|
|
state: present
|
|
hour: "5"
|
|
minute: "20"
|
|
day: "*"
|
|
job: /bin/systemctl reload matrix-nginx-proxy.service
|
|
when: matrix_nginx_proxy_enabled|bool
|
|
when: "matrix_ssl_retrieval_method == 'lets-encrypt'"
|
|
|
|
|
|
#
|
|
# Tasks related to getting rid of Let's Encrypt's management of certificates
|
|
#
|
|
|
|
# When nginx-proxy is disabled, make sure its reloading cronjob is gone.
|
|
# Other cronjobs can potentially remain there (see below).
|
|
- name: Ensure matrix-nginx-proxy-reload cronjob removed
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
name: matrix-nginx-proxy-reload
|
|
state: absent
|
|
when: "not matrix_nginx_proxy_enabled|bool"
|
|
|
|
# When Let's Encrypt is not used at all, remove all cronjobs in that cron file.
|
|
- name: Ensure matrix-ssl-lets-encrypt-renew cronjob removed
|
|
cron:
|
|
user: root
|
|
cron_file: matrix-ssl-lets-encrypt
|
|
state: absent
|
|
when: "matrix_ssl_retrieval_method != 'lets-encrypt'"
|
|
|
|
- name: Ensure Let's Encrypt SSL renewal script removed
|
|
file:
|
|
path: /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew
|
|
state: absent
|
|
when: "matrix_ssl_retrieval_method != 'lets-encrypt'"
|