Prepare services for lego certificate service

roles/acme_dns/tasks/main.yml

@@ -26,6 +26,12 @@
         src: config.cfg.j2
         dest: "{{ (config_path, 'config.cfg') | path_join }}"
         mode: "0600"
+      register: cmd_result
+
+    - name: Set the docker force-recreate flag
+      ansible.builtin.set_fact:
+        docker_force_recreate: --force-recreate
+      when: cmd_result.changed # noqa: no-handler We need to handle the restart per service. Handlers don't support variables.
 
     - name: Import start tasks for common service
       ansible.builtin.import_tasks: tasks/start-common-service.yml

roles/acme_dns/templates/config.cfg.j2

@@ -6,6 +6,7 @@ nsname = "{{ svc.domain }}"
 nsadmin = "{{ svc.nsadmin }}"
 records = [
     "{{ svc.domain }}. A {{ svc.records.a }}",
+    "{{ svc.domain }}. AAAA {{ svc.records.aaaa }}",
     "{{ svc.domain }}. NS {{ svc.domain }}.",
 ]
 debug = false

roles/acme_dns/vars/main.yml

@@ -6,6 +6,7 @@ acme_dns_svc:
   nsadmin: "{{ admin_email | regex_replace('@', '.') }}"
   records:
     a: "{{ ansible_facts.default_ipv4.address }}"
+    aaaa: "{{ ansible_facts.default_ipv6.address }}"
   db:
     host: "{{ postgres.host }}"
     port: "{{ postgres.port }}"

roles/harbor/vars/main.yml

@@ -36,8 +36,8 @@ harbor_yml:
     port: "{{ harbor_port_http }}"
   https:
     port: "{{ harbor_port_https }}"
-    certificate: /opt/services/.lego/certificates/registry.serguzim.me.crt # TODO
-    private_key: /opt/services/.lego/certificates/registry.serguzim.me.key # TODO
+    certificate: "{{ (service_path, 'server.crt') | path_join }}"
+    private_key: "{{ (service_path, 'server.key') | path_join }}"
   external_url: https://registry.serguzim.me
   harbor_admin_password: "{{ vault_harbor.admin_password }}"
   data_volume: "{{ (service_path, 'data') | path_join }}"

roles/healthcheck/files/data/http

@@ -28,7 +28,7 @@ check_url ()
     fi
 }
 
-check_url "acme.serguzim.me" "/health"
+#check_url "acme.serguzim.me" "/health"
 check_url "analytics.serguzim.me"
 check_url "auth.serguzim.me"
 check_url "ci.serguzim.me"