Refactor role naming for TLS and proxy stack

- Renamed role `srv-tls-core` → `sys-svc-certs`
- Renamed role `srv-https-stack` → `sys-stk-front-pure`
- Renamed role `sys-stk-front` → `sys-stk-front-proxy`
- Updated all includes, READMEs, meta, and dependent roles accordingly

This improves clarity and consistency of naming conventions for certificate management and proxy orchestration.

See: https://chatgpt.com/share/68b19f2c-22b0-800f-ba9b-3f2c8fd427b0
This commit is contained in:
2025-08-29 14:38:20 +02:00
parent 4c7bb6d9db
commit 009bee531b
42 changed files with 45 additions and 45 deletions

View File

@@ -0,0 +1,38 @@
# Necessary to have this seperat file to pass performance tests
- name: Install certbundle
include_role:
name: pkgmgr-install
vars:
package_name: certbundle
- name: Generate SAN certificate with certbundle
command: >-
certbundle
--domains "{{ current_play_domains_all | join(',') }}"
--certbot-email "{{ users.administrator.email }}"
--certbot-acme-challenge-method "{{ CERTBOT_ACME_CHALLENGE_METHOD }}"
--chunk-size 100
{% if CERTBOT_ACME_CHALLENGE_METHOD != 'webroot' %}
--certbot-credentials-file "{{ CERTBOT_CREDENTIALS_FILE }}"
--certbot-dns-propagation-seconds "{{ CERTBOT_DNS_PROPAGATION_WAIT_SECONDS }}"
{% else %}
--letsencrypt-webroot-path "{{ LETSENCRYPT_WEBROOT_PATH }}"
{% endif %}
{{ '--mode-test' if MODE_TEST | bool else '' }}
register: certbundle_result
changed_when: "'Certificate not yet due for renewal' not in certbundle_result.stdout"
failed_when: >
certbundle_result.rc != 0
and 'too many certificates' not in (certbundle_result.stderr | lower | default(''))
and 'the service is down for maintenance or had an internal error' not in (certbundle_result.stderr | lower | default(''))
- name: Warn if LetsEncrypt was down
when: "'the service is down for maintenance or had an internal error' in (certbundle_result.stderr | lower | default(''))"
debug:
msg: >
WARNING: Let's Encrypt responded with "service down for maintenance / internal error".
Certificate request skipped; please retry later.
- name: run the san tasks once
set_fact:
run_once_san_certs: true