Merge "letsencrypt: Register email with accounts"

Zuul 3 years ago committed by Gerrit Code Review
commit fd50bb63aa

@ -15,3 +15,9 @@ authentication procedure and parse output.
on the `/etc/letsencrypt-certificates` directory. If unset, uses
system default. Useful if this conflicts with another role that
assumes a `gid` value.
.. zuul:rolevar:: letsencrypt_account_email
:default: undefined
The email address to register with accounts. Renewal mail and
other info may be sent here. Must be defined.

@ -35,3 +35,56 @@
owner: root
group: letsencrypt
mode: u=rwx,g=rx,o=,g+s
- name: Create config directory
path: /root/
state: directory
owner: root
group: root
mode: u=rwx,g=rx,o=
# An implementation note on accounts: We could share an account key
# across all our hosts and this would be the logical place to deploy
# it. However, really the only thing you can do with an account key
# is revoke a certificate if you lose the private key. It makes more
# sense to have an account per host with key material that never
# leaves the host rather than keeping a global secret that, if leaked,
# could revoke all keys simultaneously.
- name: Check for account email
that: letsencrypt_account_email is defined
- name: Configure account email
path: /root/
regexp: '^ACCOUNT_EMAIL='
line: 'ACCOUNT_EMAIL={{ letsencrypt_account_email }}'
create: true
register: account_email
# If we updated the email and we have existing accounts, we should
# update the address.
# NOTE(ianw) 2020-03-04 : dumps the 200 response json from the
# ACME api when creating an account into this file to keep track of
# the account-id. However, it doesn't actually then update it in
# response to --updateaccount although the details in the account
# *are* correctly updated. It doesn't make a difference to ongoing
# operation since all that cares about is the unchanging id, but can
# be confusing if you check this and don't see an updated email
# address. I have filed:
- name: Check for existing account setup
path: '{{ item }}'
- /root/
- /root/
register: existing_accounts
- name: Run account update # noqa 503
shell: |
/opt/ --debug --updateaccount
when: account_email.changed and (existing_accounts.results | selectattr('stat.exists') | map(attribute='item') | list | length > 0)

@ -4,3 +4,5 @@
# gate, only generate a place-holder self-signed cert for testing.
letsencrypt_use_staging: True
letsencrypt_self_sign_only: True

@ -130,3 +130,11 @@ def test_updated_handler(host):
def test_acme_sh_config(host):
if not host.backend.get_hostname().startswith('letsencrypt0'):
config = host.file('/root/')
assert config.exists
assert config.contains("^ACCOUNT_EMAIL=''")