rc/servers
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects 1 Releases Wiki Activity

proxmox: support certificate renewals with ACME

Browse source 
Certificates must still be requested manually, this just sets the
domain and opens up port 80/tcp. Nothing listens there except for
certbot during renewals so that’s OK.
This commit is contained in:
Timotej Lazar 2024-09-04 16:54:47 +02:00
parent 1c1dd52325
commit 17c8e84498
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
roles/proxmox/tasks/main.yml
View file

@ -50,6 +50,13 @@
dest: /etc/sysctl.d/local.conf dest: /etc/sysctl.d/local.conf
src: sysctl.conf src: sysctl.conf
- name: Set domain for ACME certificate renewals
command:
cmd: 'pvenode config set --acme domains={{ interfaces | selectattr("name", "==", "lo")
| map(attribute="ip_addresses") | flatten | map(attribute="dns_name")
| sort | unique | join(";") }}'
changed_when: false # maybe write a proper check if certificate requests are ever ansibled
- include_tasks: firewall.yml - include_tasks: firewall.yml
- include_tasks: user.yml - include_tasks: user.yml

3
roles/proxmox/templates/cluster.fw.j2
View file

@ -6,8 +6,11 @@ enable: 1
IN Ping(ACCEPT) -log nolog # don’t be rude IN Ping(ACCEPT) -log nolog # don’t be rude
IN SSH(ACCEPT) -i mgmt # for ansible etc. IN SSH(ACCEPT) -i mgmt # for ansible etc.
IN HTTP(ACCEPT) # allow HTTP connections for renewing certificates with ACME
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',') }} # my cluster IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',') }} # my cluster
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',') }} # my cluster IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',') }} # my cluster
{% for service in cluster_services %} {% for service in cluster_services %}
{% set prefixes = service | allowed_prefixes %} {% set prefixes = service | allowed_prefixes %}
{% set ports = service.ports | compact_numlist(range_delimiter=':') %} {% set ports = service.ports | compact_numlist(range_delimiter=':') %}