From 9b71c5754f61a2cacf6a4f8de21f699aa3983a3b Mon Sep 17 00:00:00 2001
From: muppeth <muppeth@disroot.org>
Date: Sat, 2 Mar 2024 00:03:57 +0100
Subject: [PATCH] improved certificate redistrobution

---
 handlers/main.yml  | 12 ++++++++++++
 tasks/cert.yml     |  2 +-
 tasks/copy_ssl.yml | 27 +++++++++++++++++++--------
 3 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/handlers/main.yml b/handlers/main.yml
index 140d79e..52ddb85 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -9,3 +9,15 @@
     name: nginx
     state: reloaded
 
+- name: reload prosdy
+  systemd:
+    name: prosody
+    state: reloaded
+
+- name: reload mumble
+  systemd:
+    name: mumble-server
+    state: restarted
+
+
+
diff --git a/tasks/cert.yml b/tasks/cert.yml
index a448cfc..5d22946 100644
--- a/tasks/cert.yml
+++ b/tasks/cert.yml
@@ -1,7 +1,7 @@
 ---
 
 - name: '[CERT] - Generate or renew certificates'
-  command: /usr/bin/certbot certonly --key-type ecdsa --agree-tos --keep-until-expiring --non-interactive --webroot --webroot-path {{ letsencrypt_webroot_path }} -m {{ letsencrypt_email }} --domains {{ item.name }} --cert-name {{ item.name }} {{ '--reuse-key = true' if item.reuse_key is defined else '' }} --preferred-chain "ISRG Root X1" {{ '--force-renewal' if item.force_renewal is defined else '' }}
+  command: /usr/bin/certbot certonly --key-type ecdsa --agree-tos --keep-until-expiring --non-interactive --webroot --webroot-path {{ letsencrypt_webroot_path }} -m {{ letsencrypt_email }} --domains {{ item.name }} --cert-name {{ item.name }} {{ '--reuse-key' if item.reuse_key is defined else '' }} --preferred-chain "ISRG Root X1" {{ '--force-renewal' if item.force_renewal is defined else '' }}
   with_items: "{{ letsencrypt_domains }}"
   notify:
     - reload nginx
diff --git a/tasks/copy_ssl.yml b/tasks/copy_ssl.yml
index 5bedff9..8366b32 100644
--- a/tasks/copy_ssl.yml
+++ b/tasks/copy_ssl.yml
@@ -1,6 +1,6 @@
 ---
 
-- name: '[COPY SSL] - Fetch SSL Certificates'
+- name: '[COPY SSL] - Fetch Certificates'
   synchronize: 
     mode: pull 
     src: '/etc/letsencrypt/' 
@@ -9,12 +9,23 @@
   notify:
     - reload nginx
 
-
-- name: '[COPY SSL] - Copy SSL certificates to containers behind proxy'
-  synchronize: 
-    src: '/etc/ansible/ssl/{{ item.name }}/' 
-    dest: '/etc/letsencrypt/'
+- name: '[COPY CERTS] - Make sure direcotry permissions to cert path is correct'
+  file:
+    path: '/etc/letsencrypt/live'
+    state: 'directory'
+    owner: '{{ item.owner }}'
+    group: '{{ item.group }}'
   when: letsencrypt_copy_certs == 'true'
-  with_items: '{{ letsencrypt_copy_cert_from }}'
+  loop: '{{ letsencrypt_copy_cert_from }}'
+
+- name: '[COPY CERTS] - Copy certs archive to webservers'
+  synchronize: 
+    src: '/etc/ansible/ssl/{{ item.name }}/live/{{ item.letsencrypt_domains }}' 
+    dest: '/etc/letsencrypt/live/{{ item.domain }}'
+    owner: '{{ item.owner }}'
+    group: '{{ item.group }}'
+  when: letsencrypt_copy_certs == 'true'
+  loop: '{{ letsencrypt_copy_cert_from }}'
   notify:
-    - reload nginx
+    - reload {{ item.service }}
+