Skip to content

Commit df05b12

Browse files
geerlingguygeerlingguy
committed
Add HTTPS Let's Encrypt example using geerlingguy.certbot role.
1 parent 58ca936 commit df05b12

File tree

11 files changed

+143
-2
lines changed

11 files changed

+143
-2
lines changed

‎https-letsencrypt/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
inventory
2+
roles/geerlingguy.*

‎https-letsencrypt/README.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# HTTPS Let's Encrypt Demo
2+
3+
This demonstrates generating valid TLS certificates using Let's Encrypt and Certbot on a public web server.
4+
5+
## Quick Start Guide
6+
7+
### 1 - Install dependencies
8+
9+
1. Install [Ansible](http://docs.ansible.com/intro_installation.html).
10+
2. Install role dependencies: `ansible-galaxy install -r requirements.yml`
11+
12+
### 2 - Create a publicly-accessible VM/VPS
13+
14+
1. Create a publicly-accessible VM running Ubuntu 18.04 (on your favorite cloud provider, like AWS, DigitalOcean, etc.).
15+
2. Point a valid domain name at this server's IP address (e.g. using Route53 or your DNS provider).
16+
3. Make sure your SSH key is added to the root user account.
17+
4. Make sure you can SSH into the server using `ssh [email protected]` (where `domain.example.com` is the domain name you have pointed at the server's IP address).
18+
19+
### 3 - Configure the inventory
20+
21+
Copy the `inventory.example` to `inventory`, and change:
22+
23+
1. The server name under the `[letsencrypt]` group to the domain name pointed at your new server.
24+
2. The value for `letsencrypt_email` to an email address you control.
25+
26+
### 4 - Run the playbook
27+
28+
Run the Ansible playbook to automatically generate a Let's Encrypt certificate and use it in an example Nginx configuration:
29+
30+
ansible-playbook -i inventory main.yml
31+
32+
## About the Author
33+
34+
This project was created by [Jeff Geerling](https://www.jeffgeerling.com/) as an example for [Ansible for DevOps](https://www.ansiblefordevops.com/).

‎https-letsencrypt/ansible.cfg

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[defaults]
2+
host_key_checking = False
3+
roles_path = ./roles
4+
nocows = 1
5+
retry_files_enabled = False
6+
7+
[ssh_connection]
8+
control_path = %(directory)s/%%h-%%p-%%r
9+
pipelining = True

‎https-letsencrypt/files/index.html

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<title>HTTPS Let's Encrypt Test</title>
5+
<style>* { font-family: Helvetica, Arial, sans-serif }</style>
6+
</head>
7+
<body>
8+
<h1>HTTPS Let's Encrypt Test</h1>
9+
<p>If you can see this message, it worked!</p>
10+
</body>
11+
</html>

‎https-letsencrypt/inventory.example

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[letsencrypt]
2+
domain.example.com ansible_ssh_user=root [email protected]

‎https-letsencrypt/main.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
- hosts: all
3+
gather_facts: no
4+
5+
vars_files:
6+
- vars/main.yml
7+
8+
pre_tasks:
9+
- name: Install Python if not already present.
10+
raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)
11+
changed_when: False
12+
13+
- name: Gather facts after Python is definitely present.
14+
setup:
15+
16+
- name: Ensure apt cache is updated.
17+
apt: update_cache=yes cache_valid_time=600
18+
19+
roles:
20+
- geerlingguy.firewall
21+
- geerlingguy.nginx
22+
- geerlingguy.certbot
23+
24+
tasks:
25+
- name: Ensure docroot exists.
26+
file:
27+
path: "{{ nginx_docroot }}"
28+
state: directory
29+
30+
- name: Copy example index.html file in place.
31+
copy:
32+
src: files/index.html
33+
dest: "{{ nginx_docroot }}/index.html"
34+
mode: 0755
35+
36+
- name: Copy Nginx server configuration in place.
37+
template:
38+
src: templates/https-letsencrypt.conf.j2
39+
dest: /etc/nginx/sites-enabled/https-letsencrypt.conf
40+
mode: 0644
41+
notify: restart nginx

‎https-letsencrypt/requirements.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
- src: geerlingguy.firewall
3+
- src: geerlingguy.certbot
4+
- src: geerlingguy.nginx

‎https-letsencrypt/templates/https-letsencrypt.conf.j2

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# HTTPS server configuration.
2+
3+
# Redirect HTTP traffic to HTTPS.
4+
server {
5+
listen 80 default_server;
6+
server_name _;
7+
index index.html;
8+
return 301 https://$host$request_uri;
9+
}
10+
11+
# Serve HTTPS traffic using the self-signed certificate created by Ansible.
12+
server {
13+
listen 443 ssl default_server;
14+
server_name {{ inventory_hostname }};
15+
root {{ nginx_docroot }};
16+
17+
ssl_certificate /etc/letsencrypt/live/{{ inventory_hostname }}/fullchain.pem;
18+
ssl_certificate_key /etc/letsencrypt/live/{{ inventory_hostname }}/privkey.pem;
19+
}

‎https-letsencrypt/vars/main.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
# Firewall settings.
3+
firewall_allowed_tcp_ports:
4+
- "22"
5+
- "80"
6+
- "443"
7+
8+
# Nginx settings.
9+
nginx_vhosts: []
10+
nginx_remove_default_vhost: True
11+
nginx_ppa_use: True
12+
nginx_ppa_version: stable
13+
nginx_docroot: /var/www/html
14+
15+
# Let's Encrypt certificate settings.
16+
certbot_create_if_missing: yes
17+
certbot_admin_email: "{{ letsencrypt_email }}"
18+
certbot_certs:
19+
- domains:
20+
- "{{ inventory_hostname }}"

‎https-self-signed/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# HTTPS Self-Signed Certificate Demo VM
22

3-
This project spins up a VM and demonstrates generating self-signed certificates locally, or Let's Encrypt certificates on a public server.
3+
This project spins up a VM and demonstrates generating self-signed certificates locally.
44

55
## Quick Start Guide
66

0 commit comments

Comments
 (0)