Create roles for symfony app and ssl certificate

ansible/roles/ssl-certificate/tasks/letsencrypt.yml

@@ -0,0 +1,33 @@
+---
+- name: Check required parameters.
+  fail:
+    msg: You must set up domain and email.
+  when: not cert_domains or not cert_email
+
+- name: Create letsencrypt web root directory.
+  file:
+    name: '{{ cert_le_webroot_path }}'
+    state: directory
+
+- name: Copy notes acme server config.
+  template:
+    src: vhost.conf.j2
+    dest: "/etc/nginx/sites-enabled/{{ cert_name }}_letsencrypt.conf"
+
+- name: Restart nginx.
+  service:
+    name: nginx
+    state: restarted
+
+- name: Configure Lest Encrypt certificate.
+  include_role:
+    name: thefinn93.ansible-letsencrypt
+    private: yes
+  vars:
+    letsencrypt_webroot_path: '{{ cert_le_webroot_path }}'
+    letsencrypt_email: '{{ cert_email }}'
+    letsencrypt_cert_domains: '{{ cert_domains }}'
+    letsencrypt_renewal_command_args: '--renew-hook "systemctl restart nginx"'
+    ssl_certificate: '{{ cert_certificate }}'
+    ssl_certificate_key: '{{ cert_key }}'
+  when: False

ansible/roles/ssl-certificate/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Ensure certificate storage exists.
+  file:
+    path: '{{ cert_directory }}'
+    state: directory
+
+- include: self-signed.yml
+  when: cert_type == 'self-signed'
+
+- include: letsencrypt.yml
+  when: cert_type == 'letsencrypt'
+
+- name: Generate dhparams.
+  shell: 'openssl dhparam -out {{ cert_dhparam }} {{ cert_dhparam_n }}'
+  args:
+    creates: '{{ cert_dhparam }}'

ansible/roles/ssl-certificate/tasks/self-signed.yml

@@ -0,0 +1,33 @@
+---
+- name: Check certificate params.
+  fail:
+    msg: You must setup certificate file params.
+  when: not cert_certificate or not cert_key
+
+- name: Generate self signed ssl key.
+  shell: |
+    openssl genrsa \
+      -aes256 \
+      -passout pass:client11 \
+      -out {{ cert_directory }}/ssl.pass.key \
+      1024
+
+    openssl rsa \
+      -passin pass:client11 \
+      -in {{ cert_directory }}/ssl.pass.key \
+      -out {{ cert_key }}
+
+    openssl req \
+      -new \
+      -key {{ cert_key }} \
+      -out {{ cert_request }} \
+      -subj "/CN=localhost"
+
+    openssl x509 \
+      -req \
+      -days 365 \
+      -in {{ cert_request }} \
+      -signkey {{ cert_key }} \
+      -out {{ cert_certificate }}
+  args:
+    creates: '{{ cert_certificate }}'