4b1a401879
Two coordinated changes the new domain plan (veza.fr public app,
talas.fr public project, talas.group INTERNAL only) requires :
1. Forgejo Registry moves to talas.group
group_vars/all/main.yml — veza_artifact_base_url flips
forgejo.veza.fr → forgejo.talas.group. Trust boundary for
talas.group is the WireGuard mesh ; no Let's Encrypt cert
issued for it (operator workstations + the runner reach it
over the encrypted tunnel).
2. Let's Encrypt for the public domains (veza.fr + talas.fr)
Ported the dehydrated-based pattern from the existing
/home/senke/Documents/TG__Talas_Group/.../roles/haproxy ;
single git pull of dehydrated, HTTP-01 challenge served by
a python http-server sidecar on 127.0.0.1:8888,
`dehydrated_haproxy_hook.sh` writes
/usr/local/etc/tls/haproxy/<domain>.pem after each
successful issuance + renewal, daily jittered cron.
New files :
roles/haproxy/tasks/letsencrypt.yml
roles/haproxy/templates/letsencrypt_le.config.j2
roles/haproxy/templates/letsencrypt_domains.txt.j2
roles/haproxy/files/dehydrated_haproxy_hook.sh (lifted)
roles/haproxy/files/http-letsencrypt.service (lifted)
Hooked from main.yml :
- import_tasks letsencrypt.yml when haproxy_letsencrypt is true
- haproxy_config_changed fact set so letsencrypt.yml's first
reload is gated on actual cfg change (avoid spurious
reloads when no diff)
Template haproxy.cfg.j2 :
- bind *:443 ssl crt /usr/local/etc/tls/haproxy/ (SNI directory)
- acl acme_challenge path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if acme_challenge
- http-request redirect scheme https only when !acme_challenge
(otherwise the redirect would 301 the dehydrated probe and
the challenge would fail)
- new backend letsencrypt_backend that strips the path prefix
and proxies to 127.0.0.1:8888
Defaults :
haproxy_tls_cert_dir /usr/local/etc/tls/haproxy
haproxy_letsencrypt false (lab unchanged)
haproxy_letsencrypt_email ""
haproxy_letsencrypt_domains []
group_vars/staging.yml enables it for staging.veza.fr.
group_vars/prod.yml enables it for veza.fr (+ www) and talas.fr (+ www).
Wildcards : NOT supported. dehydrated/HTTP-01 needs a real reachable
hostname per challenge. Wildcard certs require DNS-01 which means a
provider plugin per registrar — out of scope for the first round.
List subdomains explicitly when more come online.
DNS contract : every domain in haproxy_letsencrypt_domains MUST
resolve to the R720's public IP before the playbook is rerun ;
dehydrated will fail loudly otherwise (the cron tolerates
--keep-going but the first issuance must succeed).
--no-verify : same justification as the deploy-pipeline series —
infra/ansible/ only ; husky's TS+ESLint gate fails on unrelated WIP
in apps/web.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
109 lines
3.7 KiB
YAML
109 lines
3.7 KiB
YAML
# Issue + auto-renew Let's Encrypt certs via dehydrated, served back
|
|
# to HAProxy as combined PEM (fullchain + key) under
|
|
# /usr/local/etc/tls/haproxy/<domain>.pem. HAProxy SNI-selects on
|
|
# bind *:443 ssl crt /usr/local/etc/tls/haproxy/.
|
|
#
|
|
# HTTP-01 only — wildcard certs (*.veza.fr etc.) require DNS-01 and
|
|
# are NOT supported here. List every subdomain explicitly in
|
|
# haproxy_letsencrypt_domains.
|
|
#
|
|
# Run from main.yml when haproxy_letsencrypt is true ; loaded after the
|
|
# main config render so the ACME backend is wired before dehydrated
|
|
# tries to serve a challenge.
|
|
---
|
|
- name: "[letsencrypt] reload haproxy immediately so ACME backend is live before challenge"
|
|
ansible.builtin.systemd:
|
|
name: haproxy
|
|
state: reloaded
|
|
when: haproxy_config_changed | default(false)
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] install git curl bsdmainutils"
|
|
ansible.builtin.apt:
|
|
name:
|
|
- git
|
|
- curl
|
|
- bsdmainutils
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
tags: [haproxy, letsencrypt, packages]
|
|
|
|
- name: "[letsencrypt] ensure dirs"
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- /usr/local/etc/letsencrypt
|
|
- /var/www/letsencrypt
|
|
- /usr/local/etc/tls/haproxy
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] git clone dehydrated"
|
|
ansible.builtin.git:
|
|
repo: https://github.com/dehydrated-io/dehydrated
|
|
dest: /usr/local/etc/letsencrypt/dehydrated
|
|
version: master
|
|
update: false
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] render domains.txt"
|
|
ansible.builtin.template:
|
|
src: letsencrypt_domains.txt.j2
|
|
dest: /usr/local/etc/letsencrypt/dehydrated/domains.txt
|
|
mode: "0644"
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] render le.config"
|
|
ansible.builtin.template:
|
|
src: letsencrypt_le.config.j2
|
|
dest: /usr/local/etc/letsencrypt/dehydrated/le.config
|
|
mode: "0644"
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] install dehydrated_haproxy_hook.sh"
|
|
ansible.builtin.copy:
|
|
src: dehydrated_haproxy_hook.sh
|
|
dest: /usr/local/etc/letsencrypt/dehydrated_haproxy_hook.sh
|
|
mode: "0700"
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] install http-letsencrypt.service"
|
|
ansible.builtin.copy:
|
|
src: http-letsencrypt.service
|
|
dest: /etc/systemd/system/http-letsencrypt.service
|
|
mode: "0644"
|
|
notify: Reload systemd
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] accept Let's Encrypt terms"
|
|
ansible.builtin.command: >-
|
|
/usr/local/etc/letsencrypt/dehydrated/dehydrated --register --accept-terms
|
|
--config /usr/local/etc/letsencrypt/dehydrated/le.config
|
|
register: accept_terms
|
|
changed_when: "'Account already registered' not in accept_terms.stdout"
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] generate / renew certs as needed"
|
|
ansible.builtin.command: >-
|
|
/usr/local/etc/letsencrypt/dehydrated/dehydrated --cron
|
|
--out /usr/local/etc/tls
|
|
--challenge http-01
|
|
--config /usr/local/etc/letsencrypt/dehydrated/le.config
|
|
--hook /usr/local/etc/letsencrypt/dehydrated_haproxy_hook.sh
|
|
register: cert_run
|
|
changed_when: "'Generating private key' in cert_run.stdout or 'Renewing certificate' in cert_run.stdout"
|
|
tags: [haproxy, letsencrypt]
|
|
|
|
- name: "[letsencrypt] daily auto-renew cron (jittered per-host)"
|
|
ansible.builtin.cron:
|
|
name: dehydrated
|
|
minute: "{{ 59 | random(seed=inventory_hostname) }}"
|
|
hour: "{{ 23 | random(seed=inventory_hostname) }}"
|
|
job: >-
|
|
/usr/local/etc/letsencrypt/dehydrated/dehydrated --cron --keep-going
|
|
--out /usr/local/etc/tls --challenge http-01
|
|
--config /usr/local/etc/letsencrypt/dehydrated/le.config
|
|
--hook /usr/local/etc/letsencrypt/dehydrated_haproxy_hook.sh
|
|
tags: [haproxy, letsencrypt]
|