1 files changed, 51 insertions, 0 deletions
diff --git a/roles/x509/uacme/base/tasks/main.yml b/roles/x509/uacme/base/tasks/main.yml
new file mode 100644
index 00000000..b40c52b5
--- /dev/null
+++ b/roles/x509/uacme/base/tasks/main.yml
@@ -0,0 +1,51 @@
+---
+- name: install needed packages
+  apt:
+    name:
+    - uacme
+    - "{{ python_basename }}-openssl"
+    state: present
+
+- name: create acme account key
+  command: "uacme -c /var/lib/uacme.d -a '{{ uacme_directory_server }}' -y new '{{ uacme_account_email }}'"
+  args:
+    creates: /var/lib/uacme.d/private/key.pem
+
+- name: create standard uacme webroot path
+  when: uacme_challenge_webroot_path is not defined
+  block:
+  - name: install systemd tmpfiles config
+    copy:
+      dest: /usr/lib/tmpfiles.d/uacme.conf
+      content: |
+        d /var/run/acme/acme-challenge 0755 root root - -
+    register: uacme_systemd_tmpfiles_config
+
+  - name: trigger systemd-tmpfiles
+    when: uacme_systemd_tmpfiles_config is changed
+    command: systemd-tmpfiles --create
+
+- name: create non-standard uacme webroot path
+  when: uacme_challenge_webroot_path is defined
+  file:
+    name: "{{ uacme_challenge_webroot_path }}"
+    state: directory
+
+- name: make sure nginx snipped directory exists
+  file:
+    path: /etc/nginx/snippets
+    state: directory
+
+- name: generate nginx snippet for webroot challenges
+  copy:
+    dest: /etc/nginx/snippets/uacme.conf
+    content: |
+      location /.well-known/acme-challenge/ {
+        alias {{ uacme_challenge_webroot_path | default('/var/run/acme/acme-challenge/') }};
+      }
+
+## TODO: implement this
+# - name: generate selfsigned interim certificate
+#   include_tasks: selfsigned.yml
+
+## TODO: add global automatic refresher?