[Certbot] Praise new infra

group_vars/certbot.yml

@@ -0,0 +1,8 @@
+---
+glob_certbot:
+  dns_rfc2136_server: '172.16.10.147'
+  dns_rfc2136_name: certbot_challenge.
+  dns_rfc2136_secret: "{{ vault_certbot_dns_secret }}"
+  mail: root@crans.org
+  certname: crans.org
+  domains: "crans.org"

host_vars/gitzly.adm.crans.org.yml

@@ -0,0 +1,10 @@
+---
+interfaces:
+  adm: ens18
+  srv: ens19
+
+loc_certbot:
+  dns_rfc2136_name: certbot_adm_challenge.
+  dns_rfc2136_secret: "{{ vault_certbot_adm_dns_secret }}"
+  certname: adm.crans.org
+  domains: "*.adm.crans.org"

hosts

@@ -23,6 +23,12 @@
 # [test_vm]
 # re2o-test.adm.crans.org
 
+[certbot]
+gitzly.adm.crans.org
+
+[certbot:children]
+radius  # We use certbot to manage LE certificates
+
 [nginx_rtmp]
 fluxx.adm.crans.org
 
@@ -88,6 +94,7 @@ routeur-daniel.adm.crans.org
 belenios # on changera plus tard
 re2o-ldap.adm.crans.org
 gitlab-ci.adm.crans.org
+gitzly.adm.crans.org
 hodaur.adm.crans.org
 monitoring.adm.crans.org
 boeing.adm.crans.org

plays/certbot.yml

@@ -0,0 +1,9 @@
+#!/usr/bin/env ansible-playbook
+---
+# Deploy certbot for LE certificates
+- hosts: certbot
+  vars:
+    certbot: '{{ glob_certbot | default({}) | combine(loc_certbot | default({})) }}'
+    mirror: '{{ glob_mirror }}'
+  roles:
+    - certbot

plays/freeradius.yml

@@ -3,7 +3,9 @@
 # Deploy radius server
 - hosts: radius
   vars:
+    certbot: '{{ glob_certbot | default({}) | combine(loc_certbot | default({})) }}'
     freeradius: '{{ glob_freeradius | default({}) | combine(loc_freeradius | default({})) }}'
     mirror: '{{ glob_mirror }}'
   roles:
+    - certbot
     - freeradius

radius.yml

@@ -2,12 +2,7 @@
 ---
 - hosts: eap.adm.crans.org, odlyd.adm.crans.org, radius.adm.crans.org
   vars:
-    certbot:
+    certbot: '{{ glob_certbot | default({}) | combine(loc_certbot | default({})) }}'
-      dns_rfc2136_name: certbot_challenge.
-      dns_rfc2136_secret: "{{ vault_certbot_dns_secret }}"
-      mail: root@crans.org
-      certname: crans.org
-      domains: "crans.org"
     bind:
       masters: "{{ lookup('re2oapi', 'get_role', 'dns-authoritary-master')[0] }}"
   roles:

roles/certbot/templates/letsencrypt/rfc2136.ini.j2

@@ -1,6 +1,6 @@
 {{ ansible_header | comment(decoration='# ') }}
 
-dns_rfc2136_server = {{ dns_masters_ipv4 | first }}
+dns_rfc2136_server = {{ certbot.dns_rfc2136_server }}
 dns_rfc2136_port = 53
 dns_rfc2136_name = {{ certbot.dns_rfc2136_name }}
 dns_rfc2136_secret = {{ certbot.dns_rfc2136_secret }}