diff --git a/mongodb-org-3.2/tasks/main.yml b/mongodb-org-3.2/tasks/main.yml index c574a393..cb357450 100644 --- a/mongodb-org-3.2/tasks/main.yml +++ b/mongodb-org-3.2/tasks/main.yml @@ -1,2 +1,5 @@ --- - import_tasks: mongodb.yml +- import_tasks: mongodb-letsencrypt-acmetool.yml + when: mongodb_ssl_letsencrypt_managed + diff --git a/mongodb-org-3.2/tasks/mongodb-letsencrypt-acmetool.yml b/mongodb-org-3.2/tasks/mongodb-letsencrypt-acmetool.yml new file mode 100644 index 00000000..ccadae2f --- /dev/null +++ b/mongodb-org-3.2/tasks/mongodb-letsencrypt-acmetool.yml @@ -0,0 +1,12 @@ +--- +- block: + - name: Create the acme hooks directory if it does not yet exist + file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root + + - name: Install a script that fix the letsencrypt certificate for mongodb and then reload the service + template: src=mongodb-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/mongodb owner=root group=root mode=4555 + + when: + - mongodb_ssl_letsencrypt_managed + - letsencrypt_acme_install + tags: [ 'mongodb', 'letsencrypt', 'mongodb_letsencrypt' ] diff --git a/mongodb-org-3.2/templates/mongodb-letsencrypt-acmetool.sh b/mongodb-org-3.2/templates/mongodb-letsencrypt-acmetool.sh new file mode 100644 index 00000000..4a2ae131 --- /dev/null +++ b/mongodb-org-3.2/templates/mongodb-letsencrypt-acmetool.sh @@ -0,0 +1,33 @@ +#!/bin/bash + +LE_CERTS_DIR=/etc/letsencrypt/live/$HOSTNAME +LE_LOG_DIR=/var/log/letsencrypt +MONGODB_CERTDIR=/etc/pki/mongodb +MONGODB_CERTFILE=$MONGODB_CERTDIR/mongodb.pem +DATE=$( date ) +echo "$DATE" >> $LE_LOG_DIR/mongodb.log + +if [ -f /etc/default/letsencrypt ] ; then + . /etc/default/letsencrypt +else + echo "No letsencrypt default file" >> $LE_LOG_DIR/mongodb.log + exit 1 +fi + +[ ! -d $MONGODB_CERTDIR ] && mkdir $MONGODB_CERTDIR + +echo "Building the new certificate file" >> $LE_LOG_DIR/mongodb.log +cat ${LE_CERTS_DIR}/{cert,privkey} > ${MONGODB_CERTFILE} +chmod 440 ${MONGODB_CERTFILE} +chgrp mongodb ${MONGODB_CERTFILE} + +{% if mongodb_ssl_enabled %} +echo "Reload the mongodb service" >> $LE_LOG_DIR/mongodb.log +service mongodb stop >/dev/null 2>&1 +sleep 10 +service mongodb start >/dev/null 2>&1 +{% endif %} +echo "Done." >> $LE_LOG_DIR/mongodb.log + +exit 0 +