45 lines
1.3 KiB
YAML
45 lines
1.3 KiB
YAML
- name: copy over ssl key
|
|
copy:
|
|
src: "{{ item }}"
|
|
dest: "/etc/nginx/conf.d/ssl.key"
|
|
with_first_found:
|
|
- files:
|
|
- "{{ httpd_ssl_key_file }}"
|
|
skip: True
|
|
register: setup_ssl_key
|
|
notify: restart nginx service
|
|
no_log: True
|
|
tags:
|
|
- update_ssl_certs
|
|
|
|
- name: copy over ssl pem file
|
|
copy:
|
|
src: "{{ item }}"
|
|
dest: "/etc/nginx/conf.d/ssl.pem"
|
|
with_first_found:
|
|
- files:
|
|
- "{{ httpd_ssl_pem_file }}"
|
|
- "{{ httpd_ssl_crt_file }}"
|
|
skip: True
|
|
register: setup_ssl_pem
|
|
when: setup_ssl_key is success
|
|
tags:
|
|
- update_ssl_certs
|
|
|
|
# generate our own key/crt if pem is missing
|
|
- name: generate self signed ssl certificate
|
|
command: openssl req -new -nodes -x509 -subj "{{ ssl_self_signed_string }}" -days 3650 -keyout /etc/nginx/conf.d/ssl.key -out /etc/nginx/conf.d/ssl.pem -extensions v3_ca
|
|
args:
|
|
creates: /etc/nginx/conf.d/ssl.pem
|
|
when: setup_ssl_key|failed or setup_ssl_pem|failed
|
|
|
|
- name: warn that the next step takes a while
|
|
debug:
|
|
msg: "the next step can take around 15 minutes if it hasn't already been done"
|
|
|
|
- name: create Diffie Hellman ephemeral parameters
|
|
# https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
|
|
command: openssl dhparam {{ '-dsaparam' if ssl_fast_dh else '' }} -out dhparam.pem 4096
|
|
args:
|
|
chdir: /etc/ssl/certs
|
|
creates: /etc/ssl/certs/dhparam.pem
|