From 1db30130fe3daec874e766ac1b19e4e9edca6d42 Mon Sep 17 00:00:00 2001 From: Nikita Beletskii Date: Wed, 25 May 2022 07:21:47 +0000 Subject: [PATCH 1/4] PMM-8082 add srv initialization --- .../nginx/files/generate-ssl-certificate | 35 ----- .../tasks/roles/nginx/files/ssl/ca-certs.pem | 127 ++++++++++++++++++ .../roles/nginx/files/ssl/certificate.conf | 6 + .../tasks/roles/nginx/files/ssl/dhparam.pem | 8 ++ .../nginx/files/ssl/generate-ssl-certificate | 29 ++++ .../roles/nginx/files/ssl/upgrade-certificate | 19 +++ .../playbook/tasks/roles/nginx/tasks/main.yml | 15 ++- 7 files changed, 200 insertions(+), 39 deletions(-) delete mode 100644 ansible/playbook/tasks/roles/nginx/files/generate-ssl-certificate create mode 100644 ansible/playbook/tasks/roles/nginx/files/ssl/ca-certs.pem create mode 100644 ansible/playbook/tasks/roles/nginx/files/ssl/certificate.conf create mode 100644 ansible/playbook/tasks/roles/nginx/files/ssl/dhparam.pem create mode 100644 ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate create mode 100644 ansible/playbook/tasks/roles/nginx/files/ssl/upgrade-certificate diff --git a/ansible/playbook/tasks/roles/nginx/files/generate-ssl-certificate b/ansible/playbook/tasks/roles/nginx/files/generate-ssl-certificate deleted file mode 100644 index c130c919..00000000 --- a/ansible/playbook/tasks/roles/nginx/files/generate-ssl-certificate +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/sh - -set -o errexit - -mkdir -p /srv/nginx - -if [ ! -e /srv/nginx/dhparam.pem ]; then - openssl dhparam -out /srv/nginx/dhparam.pem 2048 -fi - -if [ ! -e /srv/nginx/ca-certs.pem ]; then - # Fetch letsencrypt chain - curl https://letsencrypt.org/certs/isrgrootx1.pem > /srv/nginx/ca-certs.pem - curl https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem >> /srv/nginx/ca-certs.pem - curl https://letsencrypt.org/certs/letsencryptauthorityx1.pem >> /srv/nginx/ca-certs.pem - curl https://www.identrust.com/certificates/trustid/root-download-x3.html >> /srv/nginx/ca-certs.pem -fi - -if [ ! -e /srv/nginx/certificate.conf ]; then - echo " -[ req ] -distinguished_name = req_distinguished_name -prompt = no - -[ req_distinguished_name ] -O = Main Org. -" > /srv/nginx/certificate.conf -fi - -if [ ! -e /srv/nginx/certificate.key -o ! -e /srv/nginx/certificate.crt ]; then - openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout /srv/nginx/certificate.key \ - -out /srv/nginx/certificate.crt \ - -config /srv/nginx/certificate.conf -fi diff --git a/ansible/playbook/tasks/roles/nginx/files/ssl/ca-certs.pem b/ansible/playbook/tasks/roles/nginx/files/ssl/ca-certs.pem new file mode 100644 index 00000000..59e6e18c --- /dev/null +++ b/ansible/playbook/tasks/roles/nginx/files/ssl/ca-certs.pem @@ -0,0 +1,127 @@ +-----BEGIN CERTIFICATE----- +MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 +WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu +ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY +MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc +h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ +0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U +A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW +T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH +B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC +B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv +KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn +OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn +jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw +qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI +rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq +hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL +ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ +3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK +NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 +ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur +TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC +jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc +oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq +4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA +mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d +emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEqDCCA5CgAwIBAgIRAJgT9HUT5XULQ+dDHpceRL0wDQYJKoZIhvcNAQELBQAw +PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD +Ew5EU1QgUm9vdCBDQSBYMzAeFw0xNTEwMTkyMjMzMzZaFw0yMDEwMTkyMjMzMzZa +MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD +ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMTCCASIwDQYJKoZIhvcNAQEBBQAD +ggEPADCCAQoCggEBAJzTDPBa5S5Ht3JdN4OzaGMw6tc1Jhkl4b2+NfFwki+3uEtB +BaupnjUIWOyxKsRohwuj43Xk5vOnYnG6eYFgH9eRmp/z0HhncchpDpWRz/7mmelg +PEjMfspNdxIknUcbWuu57B43ABycrHunBerOSuu9QeU2mLnL/W08lmjfIypCkAyG +dGfIf6WauFJhFBM/ZemCh8vb+g5W9oaJ84U/l4avsNwa72sNlRZ9xCugZbKZBDZ1 +gGusSvMbkEl4L6KWTyogJSkExnTA0DHNjzE4lRa6qDO4Q/GxH8Mwf6J5MRM9LTb4 +4/zyM2q5OTHFr8SNDR1kFjOq+oQpttQLwNh9w5MCAwEAAaOCAZIwggGOMBIGA1Ud +EwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMH8GCCsGAQUFBwEBBHMwcTAy +BggrBgEFBQcwAYYmaHR0cDovL2lzcmcudHJ1c3RpZC5vY3NwLmlkZW50cnVzdC5j +b20wOwYIKwYBBQUHMAKGL2h0dHA6Ly9hcHBzLmlkZW50cnVzdC5jb20vcm9vdHMv +ZHN0cm9vdGNheDMucDdjMB8GA1UdIwQYMBaAFMSnsaR7LHH62+FLkHX/xBVghYkQ +MFQGA1UdIARNMEswCAYGZ4EMAQIBMD8GCysGAQQBgt8TAQEBMDAwLgYIKwYBBQUH +AgEWImh0dHA6Ly9jcHMucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcwPAYDVR0fBDUw +MzAxoC+gLYYraHR0cDovL2NybC5pZGVudHJ1c3QuY29tL0RTVFJPT1RDQVgzQ1JM +LmNybDATBgNVHR4EDDAKoQgwBoIELm1pbDAdBgNVHQ4EFgQUqEpqYwR93brm0Tm3 +pkVl7/Oo7KEwDQYJKoZIhvcNAQELBQADggEBANHIIkus7+MJiZZQsY14cCoBG1hd +v0J20/FyWo5ppnfjL78S2k4s2GLRJ7iD9ZDKErndvbNFGcsW+9kKK/TnY21hp4Dd +ITv8S9ZYQ7oaoqs7HwhEMY9sibED4aXw09xrJZTC9zK1uIfW6t5dHQjuOWv+HHoW +ZnupyxpsEUlEaFb+/SCI4KCSBdAsYxAcsHYI5xxEI4LutHp6s3OT2FuO90WfdsIk +6q78OMSdn875bNjdBYAqxUp2/LEIHfDBkLoQz0hFJmwAbYahqKaLn73PAAm1X2kj +f1w8DdnkabOLGeOVcj9LQ+s67vBykx4anTjURkbqZslUEUsn2k5xeua2zUk= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFjTCCA3WgAwIBAgIRAOeTkL6SBwNJGF95dYHlyoMwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTIwMDIw +WhcNMjAwNjA0MTIwMDIwWjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg +RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDEwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc0wzwWuUuR7dyXTeDs2hjMOrX +NSYZJeG9vjXxcJIvt7hLQQWrqZ41CFjssSrEaIcLo+N15Obzp2JxunmBYB/XkZqf +89B4Z3HIaQ6Vkc/+5pnpYDxIzH7KTXcSJJ1HG1rrueweNwAcnKx7pwXqzkrrvUHl +Npi5y/1tPJZo3yMqQpAMhnRnyH+lmrhSYRQTP2XpgofL2/oOVvaGifOFP5eGr7Dc +Gu9rDZUWfcQroGWymQQ2dYBrrErzG5BJeC+ilk8qICUpBMZ0wNAxzY8xOJUWuqgz +uEPxsR/DMH+ieTETPS02+OP88jNquTkxxa/EjQ0dZBYzqvqEKbbUC8DYfcOTAgMB +AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU +BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB +FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBSo +SmpjBH3duubRObemRWXv86jsoTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js +LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF +BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG +AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD +VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB +AGvM/XGv8yafGRGMPP6hnggoI9DGWGf4l0mzjBhuCkDVqoG/7rsH1ytzteePxiA3 +7kqSBo0fXu5GmbWOw09GpwPYyAAY0iWOMU6ybrTJHS466Urzoe/4IwLQoQc219EK +lh+4Ugu1q4KxNY1qMDA/1YX2Qm9M6AcAs1UvZKHSpJQAbsYrbN6obNoUGOeG6ONH +Yr8KRQz5FMfZYcA49fmdDTwKn/pyLOkJFeA/dm/oP99UmKCFoeOa5w9YJr2Vi7ic +Xd59CU8mprWhxFXnma1oU3T8ZNovjib3UHocjlEJfNbDy9zgKTYURcMVweo1dkbH +NbLc5mIjIk/kJ+RPD+chR+gJjy3Gh9xMNkDrZQKfsIO93hxTsZMmgZQ4c+vujC1M +jSak+Ai87YZeYQPh1fCGMSTno5III37DUCtIn8BJxJixuPeOMKsjLLD5AtMVy0fp +d19lcUek4bjDY8/Ujb5/wfn2+Kk7z72SxWdekjtHOWBmKxqq8jDuuMw4ymg1g5n7 +R7TZ/Y3y4bTpWUDkBHFo03xNM21wBFDIrCZZeVhvDW4MtT6+Ass2bcpoHwYcGol2 +gaLDa5k2dkG41OGtXa0fY+TjdryY4cOcstJUKjv2MJku4yaTtjjECX1rJvFLnqYe +wC+FmxjgWPuyRNuLDAWK30mmpcJZ3CmD6dFtAi4h7H37 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGbTCCBVWgAwIBAgIQQAF52VhZX9wRw3JzV+kDvjANBgkqhkiG9w0BAQsFADA/ +MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT +DkRTVCBSb290IENBIFgzMB4XDTIxMDYwNDIzMjUxNloXDTI0MDkzMDIzMjUxNlow +SjELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUlkZW5UcnVzdDEnMCUGA1UEAxMeSWRl +blRydXN0IENvbW1lcmNpYWwgUm9vdCBDQSAxMIICIjANBgkqhkiG9w0BAQEFAAOC +Ag8AMIICCgKCAgEAp1AZ3j+ZPdQzRvFvUWGCsqlPj2eJXYTZU90MKNnX8P+ulUNy +mfm1XXyKwULhMVB00YENfM2bIatD4qytXoZu8wmKH1oyvaLrlPnoXArs/5jSr3Gz +tFOfTofvkry97E8yMIhLF15XxFPC9gKXjdliK78kH2KN38O4KUtJeDyTYIgi/Jna +NsjCotQsVABnNW5zvwJY8KTd5bCiJnrK4DalGRb1/bfvrj9A9W1aBP3ONMok3HQj +G10zExJdxAEl9jDdAl2f4NVHvbTrG6G7SUnYn1sC84rkJJDkYk9Pwa+LDnQXqNFy +iGp6AUnMtEZ5xhex2pgeB1n6dSGFZd2QVs77q6VgncSd+VKwi72H+Y8rIwojdjv3 +M+HJAPNp+Uui4E68fpM5hAf3RHB+/gda5bGs0RjM8jXlSUkIylbJPfsPGH2LO8ET +wk2PyU8ON+kfoQ5q32IuyzUGUXksyCU49PpLp4lcnNLjDTmGSnR81VmHwj9ODFxS +9D33UoLx6qOs/Uk0GijzQYg6E+7o3v+ZHV+6y+ge8rlQYMAx03Pl776g7TMLdL4g +IMRnbPAIA3pVgH9GTpan9B4+4fbYCeEzZCtj1zJen/nAew94b5e8k5r5nBKQeHqA +hxXXcnScVXR4sbrhbnAEuk+gumjDe/8x8HM9PZQqsQtBDqD+TYhla3kztNcCAwEA +AaOCAlgwggJUMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMFEG +CCsGAQUFBwEBBEUwQzBBBggrBgEFBQcwAoY1aHR0cDovL3ZhbGlkYXRpb24uaWRl +bnRydXN0LmNvbS9yb290cy9kc3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKex +pHsscfrb4UuQdf/EFWCFiRAwggE8BgNVHSAEggEzMIIBLzCCASEGCmCGSAGG+S8A +BgMwggERMEoGCCsGAQUFBwIBFj5odHRwczovL3NlY3VyZS5pZGVudHJ1c3QuY29t +L2NlcnRpZmljYXRlcy9wb2xpY3kvdHMvaW5kZXguaHRtbDCBwgYIKwYBBQUHAgIw +gbUMgbJUaGlzIFRydXN0SUQgU2VydmVyIENlcnRpZmljYXRlIGhhcyBiZWVuIGlz +c3VlZCBpbiBhY2NvcmRhbmNlIHdpdGggSWRlblRydXN0J3MgVHJ1c3RJRCBDZXJ0 +aWZpY2F0ZSBQb2xpY3kgZm91bmQgYXQgaHR0cHM6Ly9zZWN1cmUuaWRlbnRydXN0 +LmNvbS8gY2VydGlmaWNhdGVzL3BvbGljeS90cy9pbmRleC5odG1sMAgGBmeBDAEC +AjA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNU +Uk9PVENBWDNDUkwuY3JsMB0GA1UdDgQWBBTtRBnA0/AGi+6ke75C5yZUyI42djAd +BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEB +AJa910o+zxHbzrH15f+W2L+4VVPiiNkae1IPgvgcbt4b9Fy8j8HQnyBkVLtTSvlS +gQ9FW/BXTlGlq1a6uaagUFCiK2FA3qPuD366RoDb/9YXMdpG2fR0LumZIXpKudWj +a3PLTl1kCDqlkjh+jODqJcc+LPth/INpfBj2Mfn1hNJvlVeu6g7/Nh/qUp61XCgQ +lUKQ2Ib4F3NN4nggaQu2DfZ5gR59wHzw9wlRKx/e+DUrVA0U22I7PPEeSuqu0HiY +ntMMcENTrbFhWHUMvlyMmTloO3+6sF4KqZXqn7HaB9mZJYC17Xl06sRiA04bVBiy +u0T0BkoisaGrHVQh2eAQHO8= +-----END CERTIFICATE----- diff --git a/ansible/playbook/tasks/roles/nginx/files/ssl/certificate.conf b/ansible/playbook/tasks/roles/nginx/files/ssl/certificate.conf new file mode 100644 index 00000000..7f7d9aeb --- /dev/null +++ b/ansible/playbook/tasks/roles/nginx/files/ssl/certificate.conf @@ -0,0 +1,6 @@ +[ req ] +distinguished_name = req_distinguished_name +prompt = no + +[ req_distinguished_name ] +O = Main Org. diff --git a/ansible/playbook/tasks/roles/nginx/files/ssl/dhparam.pem b/ansible/playbook/tasks/roles/nginx/files/ssl/dhparam.pem new file mode 100644 index 00000000..088f9673 --- /dev/null +++ b/ansible/playbook/tasks/roles/nginx/files/ssl/dhparam.pem @@ -0,0 +1,8 @@ +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== +-----END DH PARAMETERS----- \ No newline at end of file diff --git a/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate b/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate new file mode 100644 index 00000000..ac77f0e1 --- /dev/null +++ b/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate @@ -0,0 +1,29 @@ +#!/bin/sh + +set -o errexit + +mkdir -p /srv/nginx + +if [ ! -e /srv/nginx/dhparam.pem ]; then + cp /etc/nginx/ssl/dhparam.pem srv/nginx/dhparam.pem +fi + +if [ ! -e /srv/nginx/ca-certs.pem ]; then + # Fetch letsencrypt chain + cp /etc/nginx/ssl/ca-certs.pem /srv/nginx/ca-certs.pem +fi + +if [ ! -e /srv/nginx/certificate.conf ]; then + cp /etc/nginx/ssl/certificate.conf /srv/nginx/certificate.conf +fi + +if [ ! -e /srv/nginx/certificate.key -o ! -e /srv/nginx/certificate.crt ]; then + if [ ! -e /etc/nginx/ssl/certificate.key -o ! -e /etc/nginx/ssl/certificate.crt ]; then + openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ + -keyout /etc/nginx/ssl/certificate.key \ + -out /etc/nginx/ssl/certificate.crt \ + -config /etc/nginx/ssl/certificate.conf + fi + cp /etc/nginx/ssl/certificate.key /srv/nginx/certificate.key + cp /etc/nginx/ssl/certificate.crt +fi diff --git a/ansible/playbook/tasks/roles/nginx/files/ssl/upgrade-certificate b/ansible/playbook/tasks/roles/nginx/files/ssl/upgrade-certificate new file mode 100644 index 00000000..c5c77bf4 --- /dev/null +++ b/ansible/playbook/tasks/roles/nginx/files/ssl/upgrade-certificate @@ -0,0 +1,19 @@ +#!/bin/sh + +expire_limit=14 # days + +expire_data=`openssl x509 -enddate -noout -in /srv/nginx/certificate.crt | sed -e 's#notAfter=##'` +expire_date=`date -d "${expire_data}" '+%s'` +current_date=`date '+%s'` +diff="$((${expire_date}-${current_date}))" + +echo $diff + +if test "${diff}" -lt "$((${expire_limit}*24*3600))"; then + openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ + -keyout /etc/nginx/ssl/certificate.key \ + -out /etc/nginx/ssl/certificate.crt \ + -config /etc/nginx/ssl/certificate.conf + cp /etc/nginx/ssl/certificate.key /srv/nginx/certificate.key + cp /etc/nginx/ssl/certificate.crt +fi diff --git a/ansible/playbook/tasks/roles/nginx/tasks/main.yml b/ansible/playbook/tasks/roles/nginx/tasks/main.yml index e902a269..312e6c9b 100644 --- a/ansible/playbook/tasks/roles/nginx/tasks/main.yml +++ b/ansible/playbook/tasks/roles/nginx/tasks/main.yml @@ -15,17 +15,24 @@ loop: - /usr/share/pmm-server/static/ - /etc/nginx/conf.d/ + - /etc/nginx/ssl/ - name: Install nginx rpm | Install nginx rpm yum: name: nginx-1.20.1 state: installed -- name: NGINX SSL Certificate | Add script to generate ssl certificate +- name: Add ssl-related files and scripts copy: - src: generate-ssl-certificate - dest: /var/lib/cloud/scripts/per-boot/ - mode: 0755 + src: "ssl/{{ item.src }}" + dest: "{{ item.dest }}" + mode: "{{ item.mode }}" + loop: + - { src: ca-certs.pem, dest: /etc/nginx/ssl/ca-certs.pem, mode: 0400 } + - { src: certificate.conf, dest: /etc/nginx/ssl/certificate.conf, mode: 0400 } + - { src: dhparam.pem, dest: /etc/nginx/ssl/dhparam.pem, mode: 0400 } + - { src: generate-ssl-certificate, dest: /var/lib/cloud/scripts/per-boot/generate-ssl-certificate, mode: 0755 } + - { src: upgrade-certificate, dest: /var/lib/cloud/scripts/per-boot/upgrade-certificate, mode: 0755 } - name: NGINX | Copy nginx configs copy: From dbc75d5fb5ac72813f966434f693d5d61c60b987 Mon Sep 17 00:00:00 2001 From: Nikita Beletskii Date: Wed, 25 May 2022 09:59:26 +0000 Subject: [PATCH 2/4] fix --- ansible/playbook/tasks/roles/nginx/tasks/main.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ansible/playbook/tasks/roles/nginx/tasks/main.yml b/ansible/playbook/tasks/roles/nginx/tasks/main.yml index 312e6c9b..371b3e0b 100644 --- a/ansible/playbook/tasks/roles/nginx/tasks/main.yml +++ b/ansible/playbook/tasks/roles/nginx/tasks/main.yml @@ -26,13 +26,13 @@ copy: src: "ssl/{{ item.src }}" dest: "{{ item.dest }}" - mode: "{{ item.mode }}" + mode: '{{ item.mode }}' loop: - - { src: ca-certs.pem, dest: /etc/nginx/ssl/ca-certs.pem, mode: 0400 } - - { src: certificate.conf, dest: /etc/nginx/ssl/certificate.conf, mode: 0400 } - - { src: dhparam.pem, dest: /etc/nginx/ssl/dhparam.pem, mode: 0400 } - - { src: generate-ssl-certificate, dest: /var/lib/cloud/scripts/per-boot/generate-ssl-certificate, mode: 0755 } - - { src: upgrade-certificate, dest: /var/lib/cloud/scripts/per-boot/upgrade-certificate, mode: 0755 } + - { src: ca-certs.pem, dest: /etc/nginx/ssl/ca-certs.pem, mode: 'u=rw,g=r,o=r' } + - { src: certificate.conf, dest: /etc/nginx/ssl/certificate.conf, mode: 'u=rw,g=r,o=r' } + - { src: dhparam.pem, dest: /etc/nginx/ssl/dhparam.pem, mode: 'u=rw,g=r,o=r' } + - { src: generate-ssl-certificate, dest: /var/lib/cloud/scripts/per-boot/generate-ssl-certificate, mode: 'u=rwx,g=rx,o=rx' } + - { src: upgrade-certificate, dest: /var/lib/cloud/scripts/per-boot/upgrade-certificate, mode: 'u=rwx,g=rx,o=rx' } - name: NGINX | Copy nginx configs copy: From 5f3ee0cbfc2e08fc5ca0790a1c3dc15f5c236749 Mon Sep 17 00:00:00 2001 From: Nikita Beletskii Date: Wed, 25 May 2022 10:22:03 +0000 Subject: [PATCH 3/4] fix --- .../tasks/roles/nginx/files/ssl/generate-ssl-certificate | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate b/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate index ac77f0e1..46992399 100644 --- a/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate +++ b/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate @@ -5,7 +5,7 @@ set -o errexit mkdir -p /srv/nginx if [ ! -e /srv/nginx/dhparam.pem ]; then - cp /etc/nginx/ssl/dhparam.pem srv/nginx/dhparam.pem + cp /etc/nginx/ssl/dhparam.pem /srv/nginx/dhparam.pem fi if [ ! -e /srv/nginx/ca-certs.pem ]; then From 58e99b253274eac83a79c605f91d11d2e6c44e01 Mon Sep 17 00:00:00 2001 From: Nikita Beletskii Date: Wed, 25 May 2022 10:44:39 +0000 Subject: [PATCH 4/4] fix --- .../tasks/roles/nginx/files/ssl/generate-ssl-certificate | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate b/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate index 46992399..1e92bc92 100644 --- a/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate +++ b/ansible/playbook/tasks/roles/nginx/files/ssl/generate-ssl-certificate @@ -25,5 +25,5 @@ if [ ! -e /srv/nginx/certificate.key -o ! -e /srv/nginx/certificate.crt ]; then -config /etc/nginx/ssl/certificate.conf fi cp /etc/nginx/ssl/certificate.key /srv/nginx/certificate.key - cp /etc/nginx/ssl/certificate.crt + cp /etc/nginx/ssl/certificate.crt /srv/nginx/certificate.crt fi