From 8965bcf490149b81c5ad424ccbc5d0c010a1f470 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 22 Aug 2023 17:01:17 +0200
Subject: apps/coturn: move to new generic certificate roles

---
 roles/apps/coturn/tasks/main.yml | 61 ++++++++++++++++++++--------------------
 1 file changed, 30 insertions(+), 31 deletions(-)

(limited to 'roles/apps/coturn/tasks/main.yml')

diff --git a/roles/apps/coturn/tasks/main.yml b/roles/apps/coturn/tasks/main.yml
index ed0c06ab..4e5adbd5 100644
--- a/roles/apps/coturn/tasks/main.yml
+++ b/roles/apps/coturn/tasks/main.yml
@@ -1,10 +1,4 @@
 ---
-- name: check if acme_client is set to acmetool
-  assert:
-    msg: "this role currently only works with acmetool"
-    that:
-    - acme_client == "acmetool"
-
 - name: add group for coturn
   group:
     name: coturn
@@ -45,24 +39,28 @@
     group: coturn
     mode: 0644
 
-- name: install acmetool hook script
-  template:
-    src: acmetool-reload.sh.j2
-    dest: "/etc/acme/hooks/coturn-{{ coturn_realm }}"
-    mode: 0755
-
-- name: install acmetool systemd unit snippet
-  copy:
-    dest: "/etc/systemd/system/acmetool.service.d/coturn-{{ coturn_realm }}.conf"
-    content: |
-      [Service]
-      ReadWritePaths={{ coturn_base_path }}/{{ coturn_realm }}/config/ssl
-  register: coturn_acmetool_snippet
-
-- name: reload systemd
-  when: coturn_acmetool_snippet is changed
-  systemd:
-    daemon_reload: yes
+- name: compute certificate renewal config
+  set_fact:
+    coturn_certificate_renewal:
+      install:
+      - dest: "{{ coturn_base_path }}/{{ coturn_realm }}/config/ssl/cert.pem"
+        src:
+        - fullchain
+        owner: root
+        group: coturn
+        mode: "0644"
+      - dest: "{{ coturn_base_path }}/{{ coturn_realm }}/config/ssl/privkey.pem"
+        src:
+        - key
+        owner: root
+        group: coturn
+        mode: "0640"
+      reload: |
+        pod_id=$(crictl pods -q --state ready --name "^coturn-{{ coturn_realm }}-{{ ansible_nodename }}$")
+        [ -n "$pod_id" ] || exit 42
+        container_id=$(crictl ps -q --name '^coturn$' -p "$pod_id")
+        [ -n "$container_id" ] || exit 42
+        crictl stop "$container_id"
 
 - name: configure nginx vhost
   when: coturn_install_nginx_vhost
@@ -70,22 +68,23 @@
     nginx_vhost:
       name: "coturn-{{ coturn_realm }}"
       template: generic
-      tls:
-        certificate_provider: acmetool
+      tls: "{{ coturn_tls }}"
       hostnames: "{{ coturn_hostnames }}"
       locations:
         '/':
           return: "404"
+    x509_certificate_renewal: "{{ coturn_certificate_renewal }}"
   include_role:
     name: nginx/vhost
 
-- name: get certificate using acmetool
+- name: generate/install/fetch TLS certificate
   when: not coturn_install_nginx_vhost
-  import_role:
-    name: x509/acmetool/cert
   vars:
-    acmetool_cert_name: "coturn-{{ coturn_realm }}"
-    acmetool_cert_hostnames: "{{ coturn_hostnames }}"
+    x509_certificate_name: "coturn-{{ coturn_realm }}"
+    x509_certificate_hostnames: "{{ coturn_hostnames }}"
+    x509_certificate_renewal: "{{ coturn_certificate_renewal }}"
+  include_role:
+    name: "x509/{{ coturn_tls.certificate_provider }}/cert"
 
 - name: install pod manifest
   vars:
-- 
cgit v1.2.3