1
---
2
- hosts: localhost
3
  gather_facts: false
4
  vars_prompt:
5
    - name: cloudflare_api_token
6
      prompt: Cloudflare API Token
7
      private: true
8

9
  tasks:
10
    # プレイブック内にansible vaultのパスワードを読み込む
11
    - name: Load vault encrypt password
12
      ansible.builtin.include_vars:
13
        file: "secret/ansible_vault_password.yaml"
14
      no_log: true
15

16
    # ACMEアカウント用の秘密鍵を作成し
17
    - name: Generate ACME account key
18
      community.crypto.openssl_privatekey_pipe:
19
        type: RSA
20
        size: 4096
21
        content: "{{ lookup('ansible.builtin.file', 'secret/certificate/acme_account.key', errors='ignore') | default('') }}"
22
      no_log: true
23
      register: acme_account_key
24

25
    # 保存する
26
    - name: Save encrypted ACME account key
27
      when: acme_account_key.changed
28
      ansible.builtin.copy:
29
        content: "{{ acme_account_key.privatekey | vault(ansible_vault_password) }}"
30
        dest: "secret/certificate/acme_account.key"
31
        decrypt: false
32
      no_log: true
33

34
    # ACMEアカウントを作成する
35
    - name: Make sure account exists and has given contacts
36
      community.crypto.acme_account:
37
        acme_directory: "https://acme-staging-v02.api.letsencrypt.org/directory"
38
        acme_version: 2
39
        account_key_content: "{{ lookup('ansible.builtin.file','secret/certificate/acme_account.key') }}"
40
        state: present
41
        terms_agreed: true
42
        contact:
43
        - "mailto:hogehoge@example.com"
44

45
    # サーバー用秘密鍵を作成し
46
    - name: Generate OpenSSL private key
47
      community.crypto.openssl_privatekey_pipe:
48
        type: RSA
49
        size: 4096
50
        content: "{{ lookup('ansible.builtin.file', 'secret/certificate/server.key', errors='ignore') | default('') }}"
51
      no_log: true
52
      register: server_key
53

54
    # 保存する
55
    - name: Save encrypted server private key
56
      when: server_key.changed
57
      ansible.builtin.copy:
58
        content: "{{ server_key.privatekey | vault(ansible_vault_password) }}"
59
        dest: "secret/certificate/server.key"
60
        decrypt: false
61
      no_log: true
62

63
    # CSRを作成する
64
    - name: Generate an OpenSSL Certificate Signing Request
65
      community.crypto.openssl_csr_pipe:
66
        privatekey_content: "{{ lookup('ansible.builtin.file','secret/certificate/server.key') }}"
67
        common_name: '*.subdomain.example.com'
68
        subject_alt_name:
69
          - "DNS:*.subdomain.example.com"
70
      register: certificate_request
71
      changed_when: false
72

73
    # CSRを後のタスクのために変数に入れる
74
    - community.crypto.openssl_csr_info:
75
        content: "{{ certificate_request.csr }}"
76
      register: csr_info
77

78
    # CAのルート証明書を取得する
79
    - name: Download root certificate
80
      ansible.builtin.get_url:
81
        url: https://letsencrypt.org/certs/staging/letsencrypt-stg-root-x1.pem
82
        force: true
83
        dest: "secret/certificate/ca.crt"
84

85
    - name: Create a challenge using a account key file.
86
      community.crypto.acme_certificate:
87
        acme_directory: "https://acme-staging-v02.api.letsencrypt.org/directory"
88
        acme_version: 2
89
        remaining_days: 60
90
        challenge: dns-01
91
        account_key_content: "{{ lookup('ansible.builtin.file','secret/certificate/acme_account.key') }}"
92
        csr_content: "{{ certificate_request.csr }}"
93
        dest: "secret/certificate/server.crt"
94
        fullchain_dest: "secret/certificate/server-full.crt"
95
      register: challenge
96

97
    - name: Generate Certificate
98
      block:
99
        - block:
100
          # TXTレコードを作成する
101
          - name: Create a TXT record
102
            community.general.cloudflare_dns:
103
              zone: "example.com"
104
              type: TXT
105
              ttl: 120
106
              record: _acme-challenge.subdomain
107
              value: "{{ challenge.challenge_data['*.subdomain.example.com']['dns-01']['resource_value'] }}"
108
              account_email: hogehoge@example.com
109
              api_token: {{ cloudflareのAPIトークン }}
110
              state: present
111

112
          # TXTレコードが更新されるのを待つ
113
          - name: Wait Until challenge record is up
114
            ansible.builtin.debug:
115
              msg: "Waiting for record is up."
116
            retries: 10
117
            until:  lookup('community.general.dig', '_acme-challenge.subdomain.example.com', '@8.8.8.8', 'qtype=TXT') == challenge.challenge_data['*.subdomain.example.com']['dns-01']['resource_value']
118
            delay: 30
119

120
          when: challenge.authorizations['*.subdomain.example.com'].status != 'valid'
121

122
        # 証明書を発行する
123
        - name: Let the challenge be validated and retrieve the cert and intermediate certificate
124
          community.crypto.acme_certificate:
125
            acme_directory: "https://acme-staging-v02.api.letsencrypt.org/directory"
126
            acme_version: 2
127
            account_key_content: "{{ lookup('ansible.builtin.file','secret/certificate/acme_account.key') }}"
128
            account_email: hogehoge@example.com
129
            csr_content: "{{ certificate_request.csr }}"
130
            dest: "secret/certificate/server.crt"
131
            fullchain_dest: "secret/certificate/server-full.crt"
132
            challenge: dns-01
133
            remaining_days: 60
134
            data: "{{ challenge }}"
135

136
      # TXTレコードを削除する
137
      always:
138
        - name: Delete TXT record for challenge
139
          community.general.cloudflare_dns:
140
            zone: "example.com"
141
            type: TXT
142
            record: _acme-challenge.subdomain
143
            account_email: hogehoge@example.com
144
            api_token: {{ cloudflareのAPIトークン }}
145
            state: absent
146

147
      when: challenge is changed and '*.subdomain.example.com' in challenge.authorizations