90 lines
2.3 KiB
YAML
90 lines
2.3 KiB
YAML
---
|
|
# -----------------------------
|
|
# Play 1: Check remote env files
|
|
# -----------------------------
|
|
- name: Check if GoDaddy env file exists on remote hosts
|
|
hosts: acme_hosts
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Stat godaddy.env
|
|
stat:
|
|
path: "{{ acme_home }}/godaddy.env"
|
|
register: gd_env_stat
|
|
tags: acme
|
|
|
|
# -----------------------------
|
|
# Play 2: Fetch secrets from 1Password (control node)
|
|
# Only runs if any remote host is missing the env file
|
|
# -----------------------------
|
|
- name: Fetch GoDaddy API credentials from 1Password if needed
|
|
hosts: acme_hosts
|
|
# connection: local
|
|
# delegate_to: localhost
|
|
run_once: true
|
|
gather_facts: false
|
|
vars:
|
|
op_account: my.1password.com
|
|
op_item_title: godaddy-api
|
|
tasks:
|
|
- name: Determine if fetch is needed
|
|
run_once: true
|
|
delegate_to: localhost
|
|
set_fact:
|
|
fetch_godaddy_creds: >-
|
|
{{
|
|
groups['acme_hosts']
|
|
| map('extract', hostvars)
|
|
| selectattr('gd_env_stat.stat.exists','equalto',false)
|
|
| list
|
|
| length > 0
|
|
}}
|
|
|
|
- name: Get GD_Key and GD_Secret from 1Password
|
|
run_once: true
|
|
delegate_to: localhost
|
|
command: op item get "{{ op_item_title }}" --account {{ op_account }} --fields username,credential --reveal
|
|
register: godaddy_creds_raw
|
|
changed_when: false
|
|
when: fetch_godaddy_creds
|
|
|
|
- name: Split GD_Key and GD_Secret
|
|
run_once: true
|
|
# delegate_to: localhost
|
|
set_fact:
|
|
gd_key: "{{ godaddy_creds_raw.stdout.split(',')[0] }}"
|
|
gd_secret: "{{ godaddy_creds_raw.stdout.split(',')[1] }}"
|
|
when: fetch_godaddy_creds
|
|
|
|
- name: Add GD_Key and GD_Secret to hostvars for remote hosts
|
|
run_once: true
|
|
# delegate_to: localhost
|
|
add_host:
|
|
name: "{{ item }}"
|
|
gd_key: "{{ gd_key }}"
|
|
gd_secret: "{{ gd_secret }}"
|
|
loop: "{{ groups['all'] }}"
|
|
when: fetch_godaddy_creds
|
|
tags: acme
|
|
|
|
# -----------------------------
|
|
# Play 2: Run role on remote hosts
|
|
# -----------------------------
|
|
- name: ACME + Apache TLS bootstrap
|
|
hosts: all
|
|
become: true
|
|
roles:
|
|
- apache
|
|
|
|
- name: ACME
|
|
hosts: all
|
|
become: true
|
|
roles:
|
|
- acme
|
|
tags: acme
|
|
|
|
- name: plex
|
|
hosts: all
|
|
become: true
|
|
roles:
|
|
- plex
|
|
tags: plex |