mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-26 21:45:20 +02:00
Kevin Veen-Birkenbach
3a839cfe37
This commit restructures systemctl service definitions and category mappings. Motivation: Alarm-related bugs revealed inconsistencies in service and role handling. Preparation step: lays the groundwork for fixing the alarm issues by aligning categories, roles, and service templates.
38 lines
1.7 KiB
Markdown
38 lines
1.7 KiB
Markdown
# Certbot Reaper
|
|
|
|
## Description
|
|
|
|
This Ansible role automates the detection, revocation and deletion of unused Let's Encrypt certificates. It leverages the [`certreap`](https://github.com/kevinveenbirkenbach/certreap) tool to identify certificates no longer referenced by any active NGINX configuration and removes them automatically.
|
|
|
|
## Overview
|
|
|
|
- Installs the `certreap` cleanup tool using the `pkgmgr-install` role
|
|
- Deploys and configures a `sys-ctl-cln-certs{{ SYS_SERVICE_SUFFIX }}` systemd unit
|
|
- (Optionally) Sets up a recurring cleanup via a systemd timer using the `sys-timer` role
|
|
- Integrates with `sys-ctl-alm-compose` to send failure notifications
|
|
- Ensures idempotent execution with a `run_once_sys_ctl_cln_certs` flag
|
|
|
|
## Features
|
|
|
|
- **Certificate Cleanup Tool Installation**
|
|
Uses `pkgmgr-install` to install the `certreap` binary.
|
|
|
|
- **Systemd Service Configuration**
|
|
Deploys `sys-ctl-cln-certs{{ SYS_SERVICE_SUFFIX }}` and reloads/restarts it on changes.
|
|
|
|
- **Systemd Timer Scheduling**
|
|
Optionally wires in a timer via the `sys-timer` role, controlled by the `on_calendar_cleanup_certs` variable.
|
|
|
|
- **Smart Execution Logic**
|
|
Prevents multiple runs in one play by setting a `run_once_sys_ctl_cln_certs` fact.
|
|
|
|
- **Failure Notification**
|
|
Triggers `sys-ctl-alm-compose.infinito@sys-ctl-cln-certs{{ SYS_SERVICE_SUFFIX }}` on failure.
|
|
|
|
## Further Resources
|
|
|
|
- [certreap on GitHub](https://github.com/kevinveenbirkenbach/certreap)
|
|
- [Ansible community.general.pacman module](https://docs.ansible.com/ansible/latest/collections/community/general/pacman_module.html)
|
|
- [Infinito.Nexus NonCommercial License](https://s.infinito.nexus/license)
|
|
- [systemd.unit(5) manual](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)
|