0

My ansible playbook includes several roles, for example dovecot, postfix, postgres and rspamd. All of them require SSL certificates, which are generated by the certbot (lets encrypt) role. For this reason and for easier handling all roles follow the same data structure to define SSL certificates with different requirements:

certbot_domains: []

dovecot_domains: 
- name: imap1.example.com
  subject_alternative_names: []
- name: imap1.department-a.example.com
  subject_alternative_names: []
- name: pop3.example.com
  subject_alternative_names: []
- name: pop3.department-a.example.com
  subject_alternative_names: []

postfix_domains:
- name: smtp1.example.com
  subject_alternative_names:
  - smtp1.department-a.example.com

postgres_domains: 
- name: postgres.example.com
  subject_alternative_names: []

rspamd_domains:
- name: rspamd.example.com
  subject_alternative_names: 
  - rspamd.department-a.example.com

However, I want to avoid including the role certbot in the roles dovecot, postfix, postgres and rspamd which automtically creates the certificate, because each time will be installed nginx, vhosts.conf files for each domain and some snippets to provide the path /.well-known/acme-challange as alias.

To avoid each time to install nginx, configure the snippets and so on should be the tasks only run once. The variable certbot_domains shall be extended by dovecot_domains, postfix_domains, postgres_domains and rspamd_domains and the installation of nginx and their vhosts should be the last task. Perhaps the following graphic can describe the problem more precisely.

enter image description here

If there is already something from ansible, I would be very grateful for a small snippet that makes the solution more understandable.

Volker Raschek
  • 347
  • 1
  • 5
  • 17
  • After reading your question several times in the last days, I'm very unclear if you want to run a specific handler after all tasks, or just make sure you don't run the same role twice, or . My 2cent: craft an [MCVE](/help/mcve) to illustrate your exact problem. – Zeitounator Jan 11 '22 at 18:00
  • Hi @Zeitounator, I have described the problem in more detail. I hope it is now more understandable – Volker Raschek Jan 11 '22 at 21:46
  • where exactly do you define the certbot domains (in inventory, in your playbook ... ?) and how exactly and for which tasks the "non-certbot" roles use that info ? – Zeitounator Jan 11 '22 at 23:54
  • The `certbot_domains` var is defined in the `roles/certbot/default/main.yaml`. For "non-certbot" roles, if they are like setting up unix users or update system roles for example, is the `certbot_domain` var not required. – Volker Raschek Jan 12 '22 at 09:46
  • Well then I really don't get what the problem is. Those roles are totally independent. Just run them in the order you like. – Zeitounator Jan 12 '22 at 11:26

0 Answers0