430 Role vbotka.freebsd.apache HTTPS¶
Use case¶
Use the role vbotka.freebsd.certificate to create SSL certificate. Use the role
vbotka.freebsd.apache to configure Apache HTTP Server - SSL/TLS Strong Encryption. Use iocage
property host_hostname to create a jail.
Tree¶
shell> tree .
.
├── ansible.cfg
├── hosts
├── host_vars
│ ├── iocage_04
│ │ └── ansible-client-apache.yml
│ └── www-2
│ ├── apache.yml
│ └── certificate.yml
├── iocage.ini
├── pb-apache.yml
└── pb-certificate.yml
Synopsis¶
The playbook vbotka.freebsd.pb_iocage_ansible_clients.yml creates and starts one jail.
The playbook
pb-certificate.ymlcreates SSL certificate in the jail.The playbook
pb-apache.ymluses the certificate and configures Apache HTTP Server in the jail.
Requirements¶
Template
ansible_client_apachecreated in 209 Create iocage pkglist file
Notes¶
iocagepropertyhost_hostnameprovides “The hostname of the jail.”. Please note thatiocageoption--nameprovides “NAME instead of a UUID for the new jail”.In case of DHCP,
host_hostnameresolves, however--namedoes not.
ansible.cfg¶
[defaults]
gathering = explicit
callback_result_format = yaml
display_skipped_hosts = false
[connection]
pipelining = true
Inventory iocage.ini¶
iocage_04 ansible_host=10.1.0.29
[iocage]
iocage_04
[iocage:vars]
ansible_user=admin
ansible_become=true
ansible_python_interpreter=auto_silent
host_vars¶
host_vars/iocage_04/ansible-client-apache.yml¶
properties:
notes: "vmm={{ inventory_hostname }}"
bpf: 1
dhcp: 1
vnet: 1
clones_host_hostname:
www-2:
template: ansible_client_apache
host_vars/www-2/apache.yml¶
apache_install: false
apache_confd: false
apache_servername: www-2
apache_serveradmin: admin@www-2
apache_ssl: true
apache_sslengine: 'on'
apache_sslcertificatekeyfile: "/usr/local/etc/ssl/private/{{ apache_servername }}.key"
apache_sslcertificatefile: "/usr/local/etc/ssl/certs/{{ apache_servername }}.crt"
apache_httpd_conf_modules:
- {module: socache_shmcb_module, mod: mod_socache_shmcb.so}
- {module: ssl_module, mod: mod_ssl.so}
apache_directory_blocks:
- Directory: /usr/local/www/apache24/data/
Includefile: usr-local-www-apache-data.conf
Conf:
- "DirectoryIndex index.html index.htm"
- "Options Indexes FollowSymLinks"
- "AllowOverride All"
- "Require all granted"
host_vars/www-2/certificate.yml¶
certificate_data_simple:
- www-2
Create and start the jail¶
(env) > ansible-playbook vbotka.freebsd.pb_iocage_ansible_clients.yml \
-i iocage.ini \
-t clone_host_hostname -e clone_host_hostname=true
PLAY [Create and start jails. Optionally stop and destroy jails.] **************
TASK [Create clones host_hostname] *********************************************
changed: [iocage_04] => (item=www-2 ansible_client_apache)
TASK [Start clones host_hostname] **********************************************
changed: [iocage_04]
PLAY RECAP *********************************************************************
iocage_04 : ok=2 changed=2 unreachable=0 failed=0 skipped=4 rescued=0 ignored=0
Inventory hosts¶
hosts¶
www-2
[www]
www-2
[www:vars]
ansible_user=admin
ansible_become=true
ansible_python_interpreter=auto_silent
Playbook pb-certificate.yml¶
- name: Create SSL certificate.
hosts: www
gather_facts: true
roles:
- vbotka.freebsd.certificate
Playbook output - Display variables¶
(env) > ansible-playbook pb-certificate.yml -i hosts \
-t certificate_debug -e certificate_debug=true
PLAY [Create SSL certificate.] *************************************************
TASK [Gathering Facts] *********************************************************
ok: [www-2]
TASK [Vars: Include OS vars] ***************************************************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/default.yml)
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/FreeBSD.yml)
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults.yml)
TASK [vbotka.freebsd.certificate : Vars: Add certificate_data_simple to certificate_data] ***
ok: [www-2]
TASK [vbotka.freebsd.certificate : Debug certificate_debug=true] ***************
ok: [www-2] =>
msg: |-
certificate_role_version: 2.7.0
ansible_role_name: vbotka.freebsd.certificate
ansible_architecture: amd64
ansible_os_family: FreeBSD
ansible_distribution: FreeBSD
ansible_distribution_major_version: 14
ansible_distribution_version: 14.3
ansible_distribution_release: 14.3-RELEASE
ansible_python_version: 3.11.13
certificate_sanity: True
certificate_sanity_platform: True
certificate_sanity_ansible_version: True
certificate_sanity_packages: True
certificate_debug_classified: False
certificate_backup_conf: False
certificate_default_backend: auto
certificate_default_size: 4096
certificate_default_type: RSA
certificate_default_provider: selfsigned
certificate_owner: root
certificate_group: wheel
certificate_dir_mode: 0755
certificate_file_mode: 0644
certificate_dir: /usr/local/etc/ssl
certificate_dir_csr: /usr/local/etc/ssl/csr
certificate_dir_certs: /usr/local/etc/ssl/certs
certificate_private_owner: root
certificate_private_group: wheel
certificate_private_dir_mode: 0700
certificate_private_file_mode: 0600
certificate_private_dir: /usr/local/etc/ssl/private
certificate_acme_owner: root
certificate_acme_group: wheel
certificate_acme_dir_mode_private: 0700
certificate_acme_dir_mode_public: 0755
certificate_acme_base_dir: /usr/local
certificate_acme_dir: /usr/local/etc/letsencrypt
certificate_acme_dir_csr: /usr/local/etc/letsencrypt/csr
certificate_acme_dir_certs: /usr/local/etc/letsencrypt/archive
certificate_acme_dir_private: /usr/local/etc/letsencrypt/keys
certificate_acme_dir_challenges: /usr/local/www/apache24/data/.well-known/acme-challenge/
certificate_acme_link_crt: False
certificate_link_crt: False
certificate_self_signed_command:
[]
certificate_data:
- passphrase: ************
CN: www-2
private: www-2.key
csr: www-2.csr
crt: www-2.crt
certificate_python_version: 311
al_debug: False
al_sanity_packages_required:
FreeBSD:
default: [py311-cryptography, py311-openssl, py311-acme, acme-tiny]
Ubuntu:
bionic: [python-openssl, python-cryptography, acme-tiny]
cosmic: [python-openssl, python-cryptography, acme-tiny]
default: [python3-openssl, python3-cryptography, acme-tiny]
disco: [python-openssl, python-cryptography, acme-tiny]
eoan: [python-openssl, python-cryptography, acme-tiny]
focal:
- [python-openssl, python3-openssl]
- [python-cryptography, python3-cryptography]
- acme-tiny
freebsd_install_method: packages
freebsd_use_packages: True
freebsd_install_state: present
freebsd_install_retries: 10
freebsd_install_delay: 5
freebsd_flavors_enable: False
freebsd_flavors: [py311]
certificate_supported_linux_family: ['RedHat', 'Debian']
certificate_install: True
certificate_packages:
- security/py-cryptography
- security/py-openssl
- security/py-acme
certificate_packages2:
- security/py-acme-tiny
PLAY RECAP *********************************************************************
www-2 : ok=6 changed=0 unreachable=0 failed=0 skipped=6 rescued=0 ignored=0
Playbook output - Setup¶
(env) > ansible-playbook pb-certificate.yml -i hosts -t certificate_setup
PLAY [Create SSL certificate.] *************************************************
TASK [Gathering Facts] *********************************************************
ok: [www-2]
TASK [Vars: Include OS vars] ***************************************************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/default.yml)
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/FreeBSD.yml)
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults.yml)
TASK [vbotka.freebsd.certificate : Vars: Add certificate_data_simple to certificate_data] ***
ok: [www-2]
TASK [vbotka.freebsd.certificate : Packages: Install FreeBSD packages] *********
ok: [www-2] => (item=security/py-cryptography)
ok: [www-2] => (item=security/py-openssl)
ok: [www-2] => (item=security/py-acme)
ok: [www-2] => (item=security/py-acme-tiny)
TASK [vbotka.freebsd.certificate : Cert-dirs: Create public directories /usr/local/etc/ssl] ***
ok: [www-2] => (item=/usr/local/etc/ssl)
ok: [www-2] => (item=/usr/local/etc/ssl/certs)
ok: [www-2] => (item=/usr/local/etc/ssl/csr)
TASK [vbotka.freebsd.certificate : Cert-dirs: Create /usr/local/etc/ssl/private] ***
ok: [www-2]
TASK [vbotka.freebsd.certificate : Sanity: Get meta-data.] *********************
ok: [www-2]
TASK [vbotka.freebsd.certificate : Sanity: Get role_name.] *********************
ok: [www-2]
TASK [Sanity: Include al_sanity_platform from lib] *****************************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_sanity_platform: Setup. Collect minimal subset.] ***
ok: [www-2]
TASK [vbotka.freebsd.lib : Al_sanity_platform: Get supported platforms.] *******
ok: [www-2]
TASK [vbotka.freebsd.lib : Al_sanity_platform: Get supported versions of FreeBSD.] ***
ok: [www-2]
TASK [vbotka.freebsd.lib : Al_sanity_platform: Set test variables.] ************
included: /scratch/collections/ansible_collections/vbotka/freebsd/roles/lib/tasks/fn/al_include_sanity_platform_test_vars.yml for www-2
TASK [vbotka.freebsd.lib : Al_include_sanity_platform_test_vars: Set al_sanity_platform_test] ***
ok: [www-2]
TASK [vbotka.freebsd.lib : Al_include_sanity_platform_test_vars: Set al_sanity_platform_version_test] ***
ok: [www-2]
TASK [vbotka.freebsd.lib : Al_include_sanity_platform_test_vars: Set al_sanity_platform_version_test] ***
ok: [www-2]
TASK [Sanity: Include al_sanity_ansible_version from lib] **********************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_sanity_ansible_version: Get Ansible minimal version.] ***
ok: [www-2]
TASK [Sanity: Include al_sanity_packages from lib] *****************************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_sanity_packages: Setup. Gather minimal subset.] ***
ok: [www-2]
TASK [vbotka.freebsd.lib : Al_sanity_packages: Collect installed packages.] ****
ok: [www-2]
TASK [vbotka.freebsd.lib : Al_sanity_packages: Set list of installed packages.] ***
ok: [www-2]
PLAY RECAP *********************************************************************
www-2 : ok=24 changed=0 unreachable=0 failed=0 skipped=37 rescued=0 ignored=0
Playbook output - Create certificate¶
(env) > ansible-playbook pb-certificate.yml -i hosts -t certificate_openssl
PLAY [Create SSL certificate.] *************************************************
TASK [Gathering Facts] *********************************************************
ok: [www-2]
TASK [Vars: Include OS vars] ***************************************************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/default.yml)
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/FreeBSD.yml)
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults.yml)
TASK [vbotka.freebsd.certificate : Vars: Add certificate_data_simple to certificate_data] ***
ok: [www-2]
TASK [vbotka.freebsd.certificate : Cert-openssl-privatekey: Generate OpenSSL private keys.] ***
changed: [www-2] => (item=file:/usr/local/etc/ssl/private/www-2.key CN:www-2)
TASK [vbotka.freebsd.certificate : Cert-openssl-csr: Generate OpenSSL Certificate Signing Request.] ***
changed: [www-2] => (item= file:/usr/local/etc/ssl/csr/www-2.csr CN:www-2)
TASK [vbotka.freebsd.certificate : Cert-openssl-certificate: Generate and/or check OpenSSL certificates.] ***
changed: [www-2] => (item= file:/usr/local/etc/ssl/certs/www-2.crt CN:www-2)
PLAY RECAP *********************************************************************
www-2 : ok=8 changed=3 unreachable=0 failed=0 skipped=9 rescued=0 ignored=0
Playbook output - Display status¶
(env) > ansible-playbook pb-certificate.yml -i hosts -t certificate_openssl_stat
PLAY [Create SSL certificate.] *************************************************
TASK [Gathering Facts] *********************************************************
ok: [www-2]
TASK [Vars: Include OS vars] ***************************************************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/default.yml)
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults/FreeBSD.yml)
TASK [vbotka.freebsd.lib : Al_include_os_vars_path_incr: vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars] ***
ok: [www-2] => (item=/scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/vars/defaults.yml)
TASK [vbotka.freebsd.certificate : Vars: Add certificate_data_simple to certificate_data] ***
ok: [www-2]
TASK [vbotka.freebsd.certificate : Cert-openssl-stat: Get status of OpenSSL private keys, CSRs, and certificates.] ***
included: /scratch/collections/ansible_collections/vbotka/freebsd/roles/certificate/tasks/fn/cert-openssl-stat-item.yml for www-2 => (item=CN:www-2)
TASK [vbotka.freebsd.certificate : Cert-openssl-stat-item: Get status of OpenSSL private key, CSR, and certificate.] ***
ok: [www-2] => (item=/usr/local/etc/ssl/private/www-2.key)
ok: [www-2] => (item=/usr/local/etc/ssl/csr/www-2.csr)
ok: [www-2] => (item=/usr/local/etc/ssl/certs/www-2.crt)
TASK [vbotka.freebsd.certificate : Cert-openssl-stat-item: Display status of OpenSSL private key, CSR, and certificate.] ***
ok: [www-2] =>
msg: |-
- {exists: true, file: /usr/local/etc/ssl/private/www-2.key}
- {exists: true, file: /usr/local/etc/ssl/csr/www-2.csr}
- {exists: true, file: /usr/local/etc/ssl/certs/www-2.crt}
PLAY RECAP *********************************************************************
www-2 : ok=8 changed=0 unreachable=0 failed=0 skipped=6 rescued=0 ignored=0
Playbook pb-apache.yml¶
- name: Create Apache HTTP Server.
hosts: www
gather_facts: true
roles:
- vbotka.freebsd.apache
Playbook output - Create server¶
(env) > ansible-playbook pb-apache.yml -i hosts
PLAY [Create Apache HTTP Server.] **********************************************
TASK [Gathering Facts] *********************************************************
ok: [www-2]
TASK [Vars: Include OS vars.] **************************************************
included: vbotka.freebsd.lib for www-2
TASK [vbotka.freebsd.lib : Al_include_os_vars_path: Vars from /scratch/collections/ansible_collections/vbotka/freebsd/roles/apache/vars/defaults] ***
ok: [www-2]
TASK [vbotka.freebsd.apache : Httpd-conf: Configure parameters in /usr/local/etc/apache24/httpd.conf] ***
changed: [www-2] => (item={'regexp': 'ServerName', 'line': 'www-2'})
changed: [www-2] => (item={'regexp': 'ServerAdmin', 'line': 'admin@www-2'})
changed: [www-2] => (item={'regexp': 'ServerTokens', 'line': 'Prod'})
TASK [vbotka.freebsd.apache : Httpd-dirs: Configure directories in /usr/local/etc/apache24/Includes/] ***
changed: [www-2] => (item=/usr/local/www/apache24/data/)
TASK [vbotka.freebsd.apache : Httpd-modules: Load modules in /usr/local/etc/apache24/httpd.conf] ***
changed: [www-2] => (item={'module': 'socache_shmcb_module', 'mod': 'mod_socache_shmcb.so'})
changed: [www-2] => (item={'module': 'ssl_module', 'mod': 'mod_ssl.so'})
TASK [vbotka.freebsd.apache : Httpd-ssl: Present extra lines in /usr/local/etc/apache24/extra/httpd-ssl.conf] ***
changed: [www-2] => (item={'regexp': 'ServerName ', 'line': 'www-2:443'})
changed: [www-2] => (item={'regexp': 'ServerAdmin ', 'line': 'admin@www-2'})
ok: [www-2] => (item={'regexp': 'SSLEngine ', 'line': 'on'})
changed: [www-2] => (item={'regexp': 'SSLProtocol ', 'line': 'all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1'})
changed: [www-2] => (item={'regexp': 'SSLCipherSuite ', 'line': 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'})
changed: [www-2] => (item={'regexp': 'SSLHonorCipherOrder ', 'line': 'on'})
changed: [www-2] => (item={'regexp': 'SSLCompression ', 'line': 'off'})
changed: [www-2] => (item={'regexp': 'SSLSessionTickets ', 'line': 'off'})
changed: [www-2] => (item={'regexp': 'SSLCertificateFile ', 'line': '/usr/local/etc/ssl/certs/www-2.crt'})
changed: [www-2] => (item={'regexp': 'SSLCertificateKeyFile ', 'line': '/usr/local/etc/ssl/private/www-2.key'})
TASK [vbotka.freebsd.apache : Httpd-ssl: SSL Listen in /usr/local/etc/apache24/extra/httpd-ssl.conf] ***
ok: [www-2] => (item=Listen 443)
TASK [vbotka.freebsd.apache : Httpd-ssl: SSL in /usr/local/etc/apache24/httpd.conf] ***
changed: [www-2] => (item=Include etc/apache24/extra/httpd-ssl.conf)
TASK [vbotka.freebsd.apache : Rc-conf: Enable and Start Apache] ****************
changed: [www-2]
RUNNING HANDLER [vbotka.freebsd.apache : Enable and start apache] **************
changed: [www-2]
RUNNING HANDLER [vbotka.freebsd.apache : Restart apache] ***********************
changed: [www-2]
RUNNING HANDLER [vbotka.freebsd.apache : Reload apache] ************************
ok: [www-2]
PLAY RECAP *********************************************************************
www-2 : ok=13 changed=8 unreachable=0 failed=0 skipped=30 rescued=0 ignored=0
Results¶
Certificate
Issued To Common Name (CN) www-2 Organization (O) <Not Part Of Certificate> Organizational Unit (OU) <Not Part Of Certificate> Issued By Common Name (CN) www-2 Organization (O) <Not Part Of Certificate> Organizational Unit (OU) <Not Part Of Certificate> Validity Period Issued On Sunday, August 17, 2025 at 11:47:09 PM Expires On Wednesday, August 15, 2035 at 11:47:09 PM SHA-256 Fingerprints Certificate 6700fe438535caeebd164c17ebe2902d989a5ce271ec6d09d61e0b952e633802 Public Key 19a41208981a380cdae67256e7b14f8f887e776a10111029e1ad136a52db2e5d
Test the configuration
(env) > ssh admin@www-2 sudo service apache24 configtest Performing sanity check on apache24 configuration: Syntax OK
In a browser, open the page
https//www-2/. The content should beIt works!