Join Log in
Score:0
Volker Raschek avatar Server

ansible: trigger same handler from multiple roles at the end of the playbook

in flag
Volker Raschek

My ansible playbook includes several roles, for example dovecot, postfix, postgres and rspamd. All of them require SSL certificates, which are generated by the certbot (lets encrypt) role. For this reason and for easier handling all roles follow the same data structure to define SSL certificates with different requirements:

certbot_domains: []

dovecot_domains: 
- name: imap1.example.com
  subject_alternative_names: []
- name: imap1.department-a.example.com
  subject_alternative_names: []
- name: pop3.example.com
  subject_alternative_names: []
- name: pop3.department-a.example.com
  subject_alternative_names: []

postfix_domains:
- name: smtp1.example.com
  subject_alternative_names:
  - smtp1.department-a.example.com

postgres_domains: 
- name: postgres.example.com
  subject_alternative_names: []

rspamd_domains:
- name: rspamd.example.com
  subject_alternative_names: 
  - rspamd.department-a.example.com

However, I want to avoid including the role certbot in the roles dovecot, postfix, postgres and rspamd which automtically creates the certificate, because each time will be installed nginx, vhosts.conf files for each domain and some snippets to provide the path /.well-known/acme-challange as alias.

To avoid each time to install nginx, configure the snippets and so on should be the tasks only run once. The variable certbot_domains shall be extended by dovecot_domains, postfix_domains, postgres_domains and rspamd_domains and the installation of nginx and their vhosts should be the last task. Perhaps the following graphic can describe the problem more precisely.

enter image description here

If there is already something from ansible, I would be very grateful for a small snippet that makes the solution more understandable.

146
0 + 0
Zeitounator avatar
fr flag
Zeitounator
After reading your question several times in the last days, I'm very unclear if you want to run a specific handler after all tasks, or just make sure you don't run the same role twice, or <add whatever here because I'm lost>. My 2cent: craft an [MCVE](/help/mcve) to illustrate your exact problem.
0
Reply
Volker Raschek avatar
in flag
Volker Raschek
Hi @Zeitounator, I have described the problem in more detail. I hope it is now more understandable
0
Reply
Zeitounator avatar
fr flag
Zeitounator
where exactly do you define the certbot domains (in inventory, in your playbook ... ?) and how exactly and for which tasks the "non-certbot" roles use that info ?
0
Reply
Volker Raschek avatar
in flag
Volker Raschek
The `certbot_domains` var is defined in the `roles/certbot/default/main.yaml`. For "non-certbot" roles, if they are like setting up unix users or update system roles for example, is the `certbot_domain` var not required.
0
Reply
Zeitounator avatar
fr flag
Zeitounator
Well then I really don't get what the problem is. Those roles are totally independent. Just run them in the order you like.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.