Playbook #5

/home/zuul/src/opendev.org/opendev/system-config/playbooks/letsencrypt.yaml

Report Status CLI Date Duration Controller User Versions Hosts Plays Tasks Results Files Records
18 Jul 2025 20:47:32 +0000 00:00:24.78 bridge99.opendev.org root Ansible 2.15.13 ara 1.7.2 (client), 1.7.2 (server) Python 3.10.12 2 5 47 47 33 0
check:False tags:all

File: /home/zuul/src/opendev.org/opendev/system-config/playbooks/roles/letsencrypt-create-certs/handlers/restart_gitea.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
- name: Ensure gitea cert directy exists
  file:
    state: directory
    path: "/var/gitea/certs"
    owner: 1000
    group: 1000

- name: Put key in place
  copy:
    remote_src: yes
    src: /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
    dest: /var/gitea/certs/key.pem
    owner: root
    group: root
    mode: '0644'

- name: Put cert in place
  copy:
    remote_src: yes
    # Gitea doesn't seem to accept separate ca chain and cert files.
    # I believe it wants a single combined file as per fullchain.cer.
    src: /etc/letsencrypt-certs/{{ inventory_hostname }}/fullchain.cer
    dest: /var/gitea/certs/cert.pem
    owner: root
    group: root
    mode: '0644'

- name: Check for running gitea
  command: pgrep -f gitea
  ignore_errors: yes
  register: gitea_pids

- name: Restart gitea if running
  when: gitea_pids.rc == 0
  block:
    - name: Restart gitea web
      shell:
        cmd: docker-compose restart gitea-web
        chdir: /etc/gitea-docker/

    - name: Wait for service to start and have valid users
      uri:
        url: "https://localhost:3000/api/v1/users/root"
        validate_certs: false
        status_code: 200, 404
      register: root_user_check
      delay: 1
      retries: 300
      until: root_user_check and root_user_check.status in (200, 404)