From 08577a263651f154abb19081f0dc8b18e0f535a5 Mon Sep 17 00:00:00 2001
From: Stefan Haun <tux@netz39.de>
Date: Sun, 7 Mar 2021 16:31:39 +0100
Subject: [PATCH] Add a role that sets up an Apache site for Dehydrated
 validation

---
 roles/setup-http-dehydrated/handlers/main.yml |  5 ++++
 roles/setup-http-dehydrated/meta/main.yml     |  3 ++
 roles/setup-http-dehydrated/tasks/main.yml    | 12 ++++++++
 .../templates/apache-dehydrated.j2            | 30 +++++++++++++++++++
 4 files changed, 50 insertions(+)
 create mode 100644 roles/setup-http-dehydrated/handlers/main.yml
 create mode 100644 roles/setup-http-dehydrated/meta/main.yml
 create mode 100644 roles/setup-http-dehydrated/tasks/main.yml
 create mode 100644 roles/setup-http-dehydrated/templates/apache-dehydrated.j2

diff --git a/roles/setup-http-dehydrated/handlers/main.yml b/roles/setup-http-dehydrated/handlers/main.yml
new file mode 100644
index 0000000..670471f
--- /dev/null
+++ b/roles/setup-http-dehydrated/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: restart apache2
+  service:
+    name: apache2
+    state: restarted
diff --git a/roles/setup-http-dehydrated/meta/main.yml b/roles/setup-http-dehydrated/meta/main.yml
new file mode 100644
index 0000000..5eff279
--- /dev/null
+++ b/roles/setup-http-dehydrated/meta/main.yml
@@ -0,0 +1,3 @@
+---
+dependencies:
+- role: ansible-role-dehydrated
diff --git a/roles/setup-http-dehydrated/tasks/main.yml b/roles/setup-http-dehydrated/tasks/main.yml
new file mode 100644
index 0000000..a6f1650
--- /dev/null
+++ b/roles/setup-http-dehydrated/tasks/main.yml
@@ -0,0 +1,12 @@
+---
+- name: Add or update Apache2 site
+  template:
+    src: templates/apache-dehydrated.j2
+    dest: /etc/apache2/sites-available/{{ site_name }}.conf
+  notify: restart apache2
+
+- name: Activate Apache2 site
+  command: a2ensite {{ site_name }}
+  args:
+    creates: /etc/apache2/sites-enabled/{{ site_name }}.conf
+  notify: restart apache2
diff --git a/roles/setup-http-dehydrated/templates/apache-dehydrated.j2 b/roles/setup-http-dehydrated/templates/apache-dehydrated.j2
new file mode 100644
index 0000000..fe5faad
--- /dev/null
+++ b/roles/setup-http-dehydrated/templates/apache-dehydrated.j2
@@ -0,0 +1,30 @@
+<VirtualHost {{ ansible_default_ipv4.address }}:80 [{{ ansible_default_ipv6.address | default('::1') }}]:80>
+    ServerAdmin {{ server_admin }}
+    ServerName {{ site_name }}
+    ServerAlias {{ site_name }}
+    ErrorLog /var/log/apache2/{{ site_name }}-error.log
+    CustomLog /var/log/apache2/{{ site_name }}-access.log common
+
+    Alias /.well-known/acme-challenge /usr/local/etc/dehydrated/challenge
+</VirtualHost>
+
+<IfFile /usr/local/etc/dehydrated/certs/{{ site_name }}>
+<VirtualHost {{ ansible_default_ipv4.address }}:443 [{{ ansible_default_ipv6.address | default('::1') }}]:80>
+    ServerAdmin {{ server_admin }}
+    ServerName {{ site_name }}
+    ServerAlias {{ site_name }}
+
+    ErrorLog /var/log/apache2/{{ site_name }}-error.log
+    CustomLog /var/log/apache2/{{ site_name }}-access.log common
+
+    SSLEngine on
+    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
+    SSLCertificateFile    /usr/local/etc/dehydrated/certs/{{ site_name }}/cert.pem
+    SSLCertificateKeyFile /usr/local/etc/dehydrated/certs/{{ site_name }}/privkey.pem
+    SSLCertificateChainFile /usr/local/etc/dehydrated/certs/{{ site_name }}/chain.pem
+
+    Alias /.well-known/acme-challenge /usr/local/etc/dehydrated/challenge
+
+    Redirect 404 /
+</VirtualHost>
+</IfFile>