b742bfc911
We are seeing:
fatal: [adns1.opendev.org]: FAILED! => {"msg": "The task includes an
option with an undefined variable. The error was:
'ansible.vars.hostvars.HostVarsVars object' has no attribute
'acme_txt_required'
I belive this is because we have a disabled mirror host now. So the
iad.rx.opendev.org mirror is in the "letsencrypt" group, but because
it is also disabled the prior role (letsencrypt-request-certs) has not
run and it has not populated it's "acme_txt_required" variable.
We should skip disabled hosts when inspecting the hosts for this
variable. Add this to the "with_inventory_hostnames" match.
Change-Id: I33a1c8b6f7e8499248e370f69a9f573a2bf106a5
36 lines
1005 B
YAML
36 lines
1005 B
YAML
- name: Make key list
|
|
set_fact:
|
|
acme_txt_keys: []
|
|
|
|
- name: Build key list
|
|
set_fact:
|
|
acme_txt_keys: '{{ acme_txt_keys }} + {{ hostvars[item]["acme_txt_required"] }}'
|
|
with_inventory_hostnames:
|
|
- letsencrypt:!disabled
|
|
|
|
- name: Final list
|
|
debug:
|
|
var: acme_txt_keys
|
|
|
|
# NOTE(ianw): Most of the time, we won't have anything to actually do
|
|
# as we don't have new keys or renewals due.
|
|
- name: Deploy TXT records
|
|
block:
|
|
- name: Deploy new zone.db
|
|
template:
|
|
src: zone.db.j2
|
|
dest: /var/lib/bind/zones/acme.opendev.org/zone.db
|
|
|
|
- name: debug new file
|
|
slurp:
|
|
src: '/var/lib/bind/zones/acme.opendev.org/zone.db'
|
|
register: bind_zone_result
|
|
- debug:
|
|
msg: "{{ bind_zone_result['content'] | b64decode }}"
|
|
|
|
- name: Ensure domain is valid
|
|
shell: named-checkzone acme.opendev.org /var/lib/bind/zones/acme.opendev.org/zone.db
|
|
|
|
- name: Reload domain
|
|
shell: rndc reload acme.opendev.org
|
|
when: acme_txt_keys | length > 0 |