opendev/system-config
Code Issues Proposed changes

letsencrypt : use date call for serial number

Browse Source 
Per [1] ansible_date_time is NOT actually the date/time -- it is the
time cached from the facts.  It seems this can not be changed because,
of course, things have started depending on this behaviour.

This is particuarly incorrect if you're using this as a serial number
for DNS and it is not incrementing across runs, and thus bind is
refusing to load the new entries in the acme.opendev.org zone during
letsencrypt runs, and the TXT authentication fails.

Use the suggested work-around in the issue which is an external call
to date.

[1] https://github.com/ansible/ansible/issues/22561

Change-Id: Ic3f12f52e8fbb87a7cd673c37c6c4280c56c2b0f
This commit is contained in:
Ian Wienand 2019-05-22 16:41:51 +10:00
parent 2e9992af9e
commit 93bb1d549e
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
playbooks/roles/letsencrypt-install-txt-record/templates/zone.db.j2
View File

@ -2,7 +2,7 @@
$ORIGIN acme.opendev.org.
$TTL 1m
@ IN SOA adns1.opendev.org. hostmaster.opendev.org. (
{{ ansible_date_time.epoch }} ; serial number unixtime
{{ lookup('pipe', 'date +%s') }} ; serial number unixtime
1h ; refresh (secondary checks for updates)
10m ; retry (secondary retries failed axfr)
10d ; expire (secondary ends serving old data)