diff options
author | Christian Pointner <equinox@spreadspace.org> | 2023-08-17 00:38:13 +0200 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2023-08-20 22:12:03 +0200 |
commit | 2ae1b55727449c61b320703a11bc622ec76b579a (patch) | |
tree | 4b106abcf72b9bcc686efef521df3e5467dbca8f /roles/x509/uacme | |
parent | revamp x509 service reloading (diff) |
uacme: add automatic refresh timer/service
Diffstat (limited to 'roles/x509/uacme')
-rw-r--r-- | roles/x509/uacme/base/tasks/main.yml | 15 | ||||
-rw-r--r-- | roles/x509/uacme/base/templates/uacme-reconcile.service.j2 | 18 | ||||
-rw-r--r-- | roles/x509/uacme/base/templates/uacme-reconcile.timer.j2 | 10 |
3 files changed, 42 insertions, 1 deletions
diff --git a/roles/x509/uacme/base/tasks/main.yml b/roles/x509/uacme/base/tasks/main.yml index 9d67e0e7..17e6034f 100644 --- a/roles/x509/uacme/base/tasks/main.yml +++ b/roles/x509/uacme/base/tasks/main.yml @@ -50,4 +50,17 @@ dest: /usr/local/bin/uacme-reconcile.sh mode: 0755 -## TODO: add systemd units for automatic refreshing +- name: install systemd unit for automatic refresh + loop: + - service + - timer + template: + src: "uacme-reconcile.{{ item }}.j2" + dest: "/etc/systemd/system/uacme-reconcile.{{ item }}" + +- name: make sure systemd timer for automatic refresh is enabled and started + systemd: + daemon_reload: yes + name: uacme-reconcile.timer + state: started + enabled: yes diff --git a/roles/x509/uacme/base/templates/uacme-reconcile.service.j2 b/roles/x509/uacme/base/templates/uacme-reconcile.service.j2 new file mode 100644 index 00000000..c2fe917a --- /dev/null +++ b/roles/x509/uacme/base/templates/uacme-reconcile.service.j2 @@ -0,0 +1,18 @@ +[Unit] +Description=Reconcile Let's Encrypt certificates using uacme + +[Service] +Type=oneshot +ExecStart=/usr/local/bin/uacme-reconcile.sh +TimeoutStartSec=5min +CapabilityBoundingSet=CAP_CHOWN CAP_NET_BIND_SERVICE +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ReadWritePaths=/var/lib/uacme.d {{ uacme_challenge_webroot_path | default('/var/run/acme/acme-challenge') }} +ProtectHome=yes +ProtectKernelTunables=yes +ProtectControlGroups=yes +RestrictRealtime=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 diff --git a/roles/x509/uacme/base/templates/uacme-reconcile.timer.j2 b/roles/x509/uacme/base/templates/uacme-reconcile.timer.j2 new file mode 100644 index 00000000..6d37a162 --- /dev/null +++ b/roles/x509/uacme/base/templates/uacme-reconcile.timer.j2 @@ -0,0 +1,10 @@ +[Unit] +Description=Reconcile Let's Encrypt certificates using uacme + +[Timer] +OnCalendar=*-*-* 00,12:00:00 +RandomizedDelaySec=1h +Persistent=yes + +[Install] +WantedBy=timers.target |