Haproxy: Make sure certificates can be deployed in case there is no c…

…ertificate present yet
OpenConext · Jul 2, 2024 · 56d084f · 56d084f
1 parent 817e053
commit 56d084f
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/roles/haproxy/tasks/get_acme_certs.yml b/roles/haproxy/tasks/get_acme_certs.yml
@@ -5,8 +5,8 @@
   become_user: acme
   become: true
 
-- name: Deploy the certificates to haproxy
+- name: Deploy the certificates to haproxy without the need for haproxy to run
   ansible.builtin.shell:
-    cmd: "DEPLOY_HAPROXY_HOT_UPDATE=yes   DEPLOY_HAPROXY_STATS_SOCKET=/var/lib/haproxy/haproxy.stats   DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs   /home/acme/.acme.sh/acme.sh --deploy -d {{ base_domain }} --deploy-hook haproxy"
+    cmd: "DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs   /home/acme/.acme.sh/acme.sh --deploy -d {{ base_domain }} --deploy-hook haproxy"
   become_user: acme
   become: true
diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml
@@ -19,6 +19,7 @@
       - socat
       - git
     state: present
+    update_cache: true
   register: haproxy_package_installed
   until: haproxy_package_installed is succeeded
 
@@ -176,6 +177,12 @@
     state: started
     enabled: true
 
+- name: Deploy the certificates to haproxy while running, ensuring that when updating certs it will hot reload haproxy
+  ansible.builtin.shell:
+    cmd: "DEPLOY_HAPROXY_HOT_UPDATE=yes   DEPLOY_HAPROXY_STATS_SOCKET=/var/lib/haproxy/haproxy.stats   DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy/certs   /home/acme/.acme.sh/acme.sh --deploy -d {{ base_domain }} --deploy-hook haproxy"
+  become_user: acme
+  become: true
+
 - name: Add lbops user to sudoers and let it reload haproxy
   ansible.builtin.copy:
     src: lbops