43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
---
|
|
################################################################################
|
|
# Created Date: Sunday December 21st 2025
|
|
# Author: Aaron Johnson aaron.johnson@akamai.com
|
|
# -----
|
|
# Last Modified: Sunday, 21st December 2025
|
|
# Modified By: the engineer formerly known as Aaron Johnson
|
|
# -----
|
|
# Copyright (c) 2025 Contact Author for details
|
|
# -----
|
|
# USAGE/DOCUMENTATION:
|
|
#
|
|
# -----
|
|
# INSTALLATION
|
|
#
|
|
# -----
|
|
# HISTORY:
|
|
# Date By Comments
|
|
# ---------- --- ---------------------------------------------------------
|
|
################################################################################
|
|
|
|
- name: Allow acme user to reload apache without password
|
|
copy:
|
|
dest: /etc/sudoers.d/acme-apache
|
|
content: |
|
|
{{ acme_user }} ALL=NOPASSWD: /bin/systemctl reload {{ apache_service }}
|
|
mode: "0440"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Allow Apache to read cert directory (SELinux)
|
|
command: semanage fcontext -a -t httpd_config_t "{{ cert_dir }}(/.*)?"
|
|
args:
|
|
creates: "/etc/selinux/targeted/contexts/files/file_contexts.local"
|
|
|
|
# - name: Apply SELinux labels
|
|
# command: restorecon -Rv "{{ cert_dir }}"
|
|
|
|
- name: Apply SELinux labels only if incorrect
|
|
command: restorecon -Rv "{{ cert_dir }}"
|
|
register: restorecon_result
|
|
changed_when: restorecon_result.stdout_lines | select("search", "Relabeled") | list | length > 0
|