mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
6c558e7feb
Eight roles switch from pkgmgr-install to sys-pip-install with global_install: true, so the console scripts land on the system PATH where systemd looks for them. btrfs-auto-balancer, certreap, certbundle and unit-suffix-remover come from PyPI by name. The three that are not published yet install from git, with repository and ref declared in meta/services.yml and resolved through vars, following the pkgmgr and web-app-taiga precedent. That satisfies the repository-declaration guard and lets the scheduled Update: Versions workflow read and bump the refs. Drops a dead guard in svc-opt-swapfile that tested run_once_pkgmgr_install, a fact nothing sets any more. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
60 lines
2.7 KiB
YAML
60 lines
2.7 KiB
YAML
---
|
|
# Necessary to have this separate file to pass performance tests
|
|
- name: 📦 Install certbundle system-wide via pip
|
|
include_role:
|
|
name: sys-pip-install
|
|
vars:
|
|
package_name: certbundle
|
|
global_install: true
|
|
|
|
- name: ⚙️ Generate SAN certificate with certbundle
|
|
command: >-
|
|
certbundle
|
|
--domains "{{ CURRENT_PLAY_DOMAINS_ALL | join(',') }}"
|
|
--certbot-email "{{ lookup('users', 'administrator').email }}"
|
|
--certbot-acme-challenge-method "{{ CERTBOT_ACME_CHALLENGE_METHOD }}"
|
|
--chunk-size 100
|
|
{% if CERTBOT_ACME_CHALLENGE_METHOD != 'webroot' %}
|
|
--certbot-credentials-file "{{ CERTBOT_CREDENTIALS_FILE }}"
|
|
--certbot-dns-propagation-seconds "{{ CERTBOT_DNS_PROPAGATION_WAIT_SECONDS }}"
|
|
{% else %}
|
|
--letsencrypt-webroot-path "{{ LETSENCRYPT_WEBROOT_PATH }}"
|
|
{% endif %}
|
|
{{ '--mode-test' if MODE_DUMMY | bool else '' }}
|
|
register: certbundle_result
|
|
changed_when: >
|
|
('certificate not yet due for renewal' not in (certbundle_result.stdout | lower | default('')))
|
|
and ('certificate not yet due for renewal' not in (certbundle_result.stderr | lower | default('')))
|
|
and ('already issued for this exact set of identifiers in the last' not in (certbundle_result.stderr | lower | default('')))
|
|
and ('too many certificates' not in (certbundle_result.stderr | lower | default('')))
|
|
and ('the service is down for maintenance or had an internal error' not in (certbundle_result.stderr | lower | default('')))
|
|
failed_when: >
|
|
certbundle_result.rc != 0
|
|
and 'too many certificates' not in (certbundle_result.stderr | lower | default(''))
|
|
and 'the service is down for maintenance or had an internal error' not in (certbundle_result.stderr | lower | default(''))
|
|
|
|
- name: ⚠️ Warn if LetsEncrypt was down
|
|
when: "'the service is down for maintenance or had an internal error' in (certbundle_result.stderr | lower | default(''))"
|
|
debug:
|
|
msg: >
|
|
WARNING: Let's Encrypt responded with "service down for maintenance / internal error".
|
|
Certificate request skipped; please retry later.
|
|
|
|
- name: ⚠️ Warn if LE rate limit (exact set) was hit
|
|
when: "'already issued for this exact set of identifiers in the last' in (certbundle_result.stderr | lower | default(''))"
|
|
debug:
|
|
msg: >
|
|
WARNING: Let's Encrypt rate limit for this exact identifier set was hit.
|
|
No changes recorded; retry after the indicated time.
|
|
|
|
- name: ⚠️ Warn if LE rate limit (generic) was hit
|
|
when: "'too many certificates' in (certbundle_result.stderr | lower | default(''))"
|
|
debug:
|
|
msg: >
|
|
WARNING: Let's Encrypt rate limit reached ("too many certificates").
|
|
No changes recorded; adjust batching or retry later.
|
|
|
|
- name: ▶️ run the san tasks once
|
|
set_fact:
|
|
run_once_san_certs: true
|