apps/mumble: add new generic certificate renewal support

6 files changed, 98 insertions, 58 deletions

diff --git a/roles/apps/mumble/tasks/main.yml b/roles/apps/mumble/tasks/main.yml
index 5cd1f7a9..b59fb5fc 100644
--- a/roles/apps/mumble/tasks/main.yml
+++ b/roles/apps/mumble/tasks/main.yml
@@ -1,10 +1,4 @@
 ---
-- name: check if acme_client is set to acmetool
-  assert:
-    msg: "this role currently only works with acmetool"
-    that:
-    - mumble_tls.certificate_provider == "acmetool"
-
 - name: add group for mumble
   group:
     name: mumble
@@ -33,31 +27,32 @@
     group: mumble
     mode: 0644
 
-- name: install acmetool hook script
-  template:
-    src: acmetool-reload.sh.j2
-    dest: "/etc/acme/hooks/mumble-{{ mumble_instance }}"
-    mode: 0755
-
-- name: install acmetool systemd unit snippet
-  copy:
-    dest: "/etc/systemd/system/acmetool.service.d/mumble-{{ mumble_instance }}.conf"
-    content: |
-      [Service]
-      ReadWritePaths={{ mumble_base_path }}/{{ mumble_instance }}/ssl
-  register: mumble_acmetool_snippet
-
-- name: reload systemd
-  when: mumble_acmetool_snippet is changed
-  systemd:
-    daemon_reload: yes
-
-- name: get certificate using acmetool
-  import_role:
-    name: x509/acmetool/cert
+- name: generate/install/fetc TLS certificate
   vars:
-    acmetool_cert_name: "mumble-{{ mumble_instance }}"
-    acmetool_cert_hostnames: "{{ mumble_hostnames }}"
+    x509_certificate_name: "mumble-{{ mumble_instance }}"
+    x509_certificate_hostnames: "{{ mumble_hostnames }}"
+    x509_certificate_renewal:
+      install:
+      - dest: "{{ mumble_base_path }}/{{ mumble_instance }}/ssl/cert.pem"
+        src:
+        - fullchain
+        owner: root
+        group: mumble
+        mode: "0644"
+      - dest: "{{ mumble_base_path }}/{{ mumble_instance }}/ssl/privkey.pem"
+        src:
+        - key
+        owner: root
+        group: mumble
+        mode: "0640"
+      reload: |
+        pod_id=$(crictl pods -q --state ready --name "^mumble-{{ mumble_instance }}-{{ ansible_nodename }}$")
+        [ -n "$pod_id" ] || exit 42
+        container_id=$(crictl ps -q --name '^mumble$' -p "$pod_id")
+        [ -n "$container_id" ] || exit 42
+        crictl exec "$container_id" kill -USR1 1
+  include_role:
+    name: "x509/{{ mumble_tls.certificate_provider }}/cert"
 
 - name: create mumble data directory
   file:
diff --git a/roles/apps/mumble/templates/acmetool-reload.sh.j2 b/roles/apps/mumble/templates/acmetool-reload.sh.j2
deleted file mode 100644
index fd9f01ba..00000000
--- a/roles/apps/mumble/templates/acmetool-reload.sh.j2
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/sh
-set -e
-EVENT_NAME="$1"
-[ "$EVENT_NAME" = "live-updated" ] || exit 42
-
-MAIN_HOSTNAME="{{ mumble_hostnames[0] }}"
-SSL_D="{{ mumble_base_path }}/{{ mumble_instance }}/ssl"
-
-while read name; do
-  certdir="$ACME_STATE_DIR/live/$name"
-  if [ -z "$name" -o ! -e "$certdir" ]; then
-    continue
-  fi
-  if [ "$name" != "$MAIN_HOSTNAME" ]; then
-    continue
-  fi
-
-  install -m 0644 -o root -g mumble "$certdir/fullchain" "$SSL_D/cert.pem"
-  install -m 0640 -o root -g mumble "$certdir/privkey" "$SSL_D/privkey.pem"
-
-  pod_id=$(crictl pods -q --state ready --name "^mumble-{{ mumble_instance }}-{{ ansible_nodename }}$")
-  [ -n "$pod_id" ] || exit 42
-  container_id=$(crictl ps -q --name '^mumble$' -p "$pod_id")
-  [ -n "$container_id" ] || exit 42
-  crictl exec "$container_id" kill -USR1 1
-
-  break
-done
diff --git a/roles/x509/acmetool/cert/finalize/handlers/main.yml b/roles/x509/acmetool/cert/finalize/handlers/main.yml
index a7fc43ed..02ffa598 100644
--- a/roles/x509/acmetool/cert/finalize/handlers/main.yml
+++ b/roles/x509/acmetool/cert/finalize/handlers/main.yml
@@ -2,5 +2,6 @@
 - name: reconcile acmetool
   when: not acmetool_reconcile_disabled
   systemd:
+    daemon_reload: yes
     name: acmetool.service
     state: started
diff --git a/roles/x509/acmetool/cert/prepare/handlers/main.yml b/roles/x509/acmetool/cert/prepare/handlers/main.yml
index b169d6ca..330bcd11 100644
--- a/roles/x509/acmetool/cert/prepare/handlers/main.yml
+++ b/roles/x509/acmetool/cert/prepare/handlers/main.yml
@@ -1,4 +1,8 @@
 ---
+- name: reload systemd
+  systemd:
+    daemon_reload: yes
+
 - name: reload services for x509 certificates
   loop: "{{ x509_certificate_reload_services | default([]) }}"
   service:
diff --git a/roles/x509/acmetool/cert/prepare/tasks/main.yml b/roles/x509/acmetool/cert/prepare/tasks/main.yml
index 5bad1e5b..2db332b8 100644
--- a/roles/x509/acmetool/cert/prepare/tasks/main.yml
+++ b/roles/x509/acmetool/cert/prepare/tasks/main.yml
@@ -40,3 +40,40 @@
     x509_certificate_path_cert: "/var/lib/acme/live/{{ acmetool_cert_hostnames[0] }}/cert"
     x509_certificate_path_chain: "/var/lib/acme/live/{{ acmetool_cert_hostnames[0] }}/chain"
     x509_certificate_path_fullchain: "/var/lib/acme/live/{{ acmetool_cert_hostnames[0] }}/fullchain"
+
+- name: setup custom renewal script
+  when: x509_certificate_renewal is defined
+  block:
+  - name: install custom hook script
+    template:
+      src: reload.sh.j2
+      dest: "/etc/acme/hooks/{{ x509_certificate_name }}"
+      mode: 0755
+
+  - name: install acmetool systemd unit snippet
+    when: "'install' in x509_certificate_renewal"
+    copy:
+      dest: "/etc/systemd/system/acmetool.service.d/{{ x509_certificate_name }}.conf"
+      content: |
+        [Service]
+        {% for path in (x509_certificate_renewal.install | map(attribute='dest') | map('dirname') | unique | list) %}
+        ReadWritePaths={{ path }}
+        {% endfor %}
+    notify: reload systemd
+
+  - name: remove acmetool systemd unit snippet
+    when: "'install' not in x509_certificate_renewal"
+    file:
+      path: "/etc/systemd/system/acmetool.service.d/{{ x509_certificate_name }}.conf"
+      state: absent
+    notify: reload systemd
+
+- name: remove custom renewal script
+  when: x509_certificate_renewal is not defined
+  loop:
+  - "/etc/systemd/system/acmetool.service.d/{{ x509_certificate_name }}.conf"
+  - "/etc/acme/hooks/{{ x509_certificate_name }}"
+  file:
+    path: "{{ item }}"
+    state: absent
+  notify: reload systemd
diff --git a/roles/x509/acmetool/cert/prepare/templates/reload.sh.j2 b/roles/x509/acmetool/cert/prepare/templates/reload.sh.j2
new file mode 100644
index 00000000..f4b8259e
--- /dev/null
+++ b/roles/x509/acmetool/cert/prepare/templates/reload.sh.j2
@@ -0,0 +1,31 @@
+#!/bin/sh
+set -e
+EVENT_NAME="$1"
+[ "$EVENT_NAME" = "live-updated" ] || exit 42
+
+MAIN_HOSTNAME="{{ acmetool_cert_hostnames[0] }}"
+
+while read name; do
+  certdir="$ACME_STATE_DIR/live/$name"
+  if [ -z "$name" -o ! -e "$certdir" ]; then
+    continue
+  fi
+  if [ "$name" != "$MAIN_HOSTNAME" ]; then
+    continue
+  fi
+{% if 'install' in x509_certificate_renewal %}
+
+{%   for file in x509_certificate_renewal.install %}
+  install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'owner' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new"
+{%     for src in file.src %}
+  cat "{{ hostvars[inventory_hostname]['x509_certificate_path_' + src] }}" >> "{{ file.dest }}.new"
+  mv "{{ file.dest }}.new" "{{ file.dest }}"
+{%     endfor %}
+{%   endfor %}
+{% endif %}
+{% if 'reload' in x509_certificate_renewal %}
+
+  {{ x509_certificate_renewal.reload | trim | indent(2) }}
+{% endif %}
+  break
+done