Add status.vm.chapo.li

all.yml

@@ -28,11 +28,12 @@
   roles:
     - { role: backup, tags: backup }
 
-# - hosts: acme
-#   roles:
-#     - role: certbot-dns
-#       tags: acme
-#   vars:
-#     cert:
-#       name: "{{ acme_domain }}"
-#       alias: "{{ acme_alias|default([]) }}"
+- hosts: acme
+  roles:
+    - role: certbot-dns
+      tags: acme
+  vars:
+    cert:
+      name: "{{ acme_domain|default(inventory_hostname) }}"
+      alias: "{{ acme_alias|default([]) }}"
+      renewal_hook: "{{ renewal_hook }}"

inventory.yml

@@ -71,6 +71,10 @@ lxc:
       ansible_host: 10.255.3.16
       resources: { cpu: 4, ram: 4096, swap: 1024, disk: 128 }
 
+    status.vm.chapo.li:
+      ansible_host: 10.255.3.17
+      resources: { cpu: 1, ram: 1024, swap: 1024, disk: 16 }
+
 
   vars:
     ansible_user: root
@@ -95,6 +99,11 @@ mail:
   hosts:
     mail.vm.chapo.li:
 
+acme:
+  hosts:
+    status.vm.chapo.li:
+      renewal_hook: systemctl restart nginx
+
 docker:
   hosts:
     cloud.vm.chapo.li:
@@ -106,6 +115,7 @@ docker:
     git.vm.chapo.li:
     todo.vm.chapo.li:
     sharkey.vm.chapo.li:
+    status.vm.chapo.li:
 
 backup:
   hosts:
@@ -167,6 +177,12 @@ backup:
         paths: [ "/root/sharkey/files", "/tmp/sharkey.sql", /root/sharkey/docker-compose.yml, /root/sharkey/.config ]
         post_hook: [ "rm /tmp/sharkey.sql" ]
 
+    status.vm.chapo.li:
+      backup:
+        pre_hook: []
+        paths: [ /root/docker-compose.yml, /root/uptime-kuma-data, /etc/nginx/sites-enabled/status.conf ]
+        post_hook: []
+
 unmanaged:
   hosts:
     freebox.gw.chapo.li:

roles/certbot-dns/README.md

@@ -7,6 +7,7 @@ usage:
   loop:
     - name: example.vm.chapo.li
       alias: [ cname.vm.chapo.li ]
+      renewal_hook: systemctl restart service
   loop_control:
     loop_var: cert
 ```

roles/certbot-dns/tasks/main.yml

@@ -11,7 +11,7 @@
     mode: 0600
 
 - name: Query lets encrypt certificate
-  shell: 'letsencrypt certonly -n --dns-rfc2136 --dns-rfc2136-credentials /root/dns-secret.ini -m {{ letsencrypt_email|default("me@chapoline.me") }} --expand --agree-tos -d {{ cert.name }} {% for a in cert.alias %} -d {{a}}{% endfor %} --deploy-hook "{{ cert.renewal_hook }}"'
+  shell: 'letsencrypt certonly -n --dns-rfc2136 --dns-rfc2136-credentials /root/dns-secret.ini -m {{ letsencrypt_email|default("me@chapoline.me") }} --expand --agree-tos -d {{ cert.name }} {% for a in cert.alias %} -d {{a}}{% endfor %} {% if cert.renewal_hook %}--deploy-hook "{{ cert.renewal_hook }}"{{ endif }}'
   ignore_errors: true
 
 - name: Create a few symbolic links