n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
60 lines
1.9 KiB
YAML
60 lines
1.9 KiB
YAML
---
|
|
# Shared TLS setup: tries certbot, falls back to self-signed
|
|
# Include with: include_tasks: ../common/tls_setup.yml
|
|
# Required vars: _tls_domain (the domain to get a cert for)
|
|
|
|
- name: Attempt TLS certificate from Let's Encrypt
|
|
command: >
|
|
certbot certonly --webroot -w /var/www/certbot
|
|
-d {{ _tls_domain }}
|
|
--non-interactive
|
|
--agree-tos
|
|
{% if certbot_email is defined and certbot_email %}
|
|
--email {{ certbot_email }}
|
|
{% else %}
|
|
--register-unsafely-without-email
|
|
{% endif %}
|
|
args:
|
|
creates: "/etc/letsencrypt/live/{{ _tls_domain }}/fullchain.pem"
|
|
register: _certbot_result
|
|
ignore_errors: true
|
|
|
|
- name: Generate self-signed certificate (fallback)
|
|
command: >
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:4096
|
|
-keyout /etc/ssl/private/{{ _tls_domain }}-selfsigned.key
|
|
-out /etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt
|
|
-subj "/CN={{ _tls_domain }}"
|
|
args:
|
|
creates: "/etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt"
|
|
when: _certbot_result is failed
|
|
|
|
- name: Set cert paths (certbot)
|
|
set_fact:
|
|
_ssl_cert: "/etc/letsencrypt/live/{{ _tls_domain }}/fullchain.pem"
|
|
_ssl_key: "/etc/letsencrypt/live/{{ _tls_domain }}/privkey.pem"
|
|
when: _certbot_result is not failed
|
|
|
|
- name: Set cert paths (self-signed)
|
|
set_fact:
|
|
_ssl_cert: "/etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt"
|
|
_ssl_key: "/etc/ssl/private/{{ _tls_domain }}-selfsigned.key"
|
|
when: _certbot_result is failed
|
|
|
|
- name: Warn about self-signed certificate
|
|
debug:
|
|
msg: "Using self-signed TLS cert. Point DNS to this server and run: certbot certonly --webroot -w /var/www/certbot -d {{ _tls_domain }}"
|
|
when: _certbot_result is failed
|
|
|
|
- name: Create Tools directory
|
|
file:
|
|
path: /root/Tools
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Deploy cert setup script
|
|
template:
|
|
src: ../common/templates/setup-cert.sh.j2
|
|
dest: /root/Tools/setup-cert.sh
|
|
mode: "0700"
|