From 49bd2f630bae62b0ad53667cab887422b548ce8d Mon Sep 17 00:00:00 2001
From: Maxim Vershinin <im@vmn.su>
Date: Mon, 14 Sep 2026 09:58:47 +0400
Subject: [PATCH] feat(role,pb,inv): new role for updating certificates on
 web-servers

---
 inventory/hosts.yaml                      |  8 ++++++++
 playbooks/maintain.yaml                   | 11 +++++++++++
 roles/update_certificates/tasks/main.yaml | 20 ++++++++++++++++++++
 3 files changed, 39 insertions(+)
 create mode 100644 roles/update_certificates/tasks/main.yaml

diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml
index c9a3be0..f70cf6e 100644
--- a/inventory/hosts.yaml
+++ b/inventory/hosts.yaml
@@ -39,3 +39,11 @@ all:
           ansible_become_password: "{{ ansible_become_passwd }}"
           services_to_run:
             - coder_ai
+    web-servers:
+      hosts:
+        cert-proxy:
+          ansible_host: 192.168.0.47
+          ansible_become_password: "{{ ansible_become_passwd }}"
+        monitoring:
+          ansible_host: 192.168.0.49
+          ansible_become_password: "{{ ansible_become_passwd }}"
diff --git a/playbooks/maintain.yaml b/playbooks/maintain.yaml
index 821de92..b0d2c71 100644
--- a/playbooks/maintain.yaml
+++ b/playbooks/maintain.yaml
@@ -20,3 +20,14 @@
     - ../roles/update_configs
     # Make sure that the services that are supposed to run are running
     - ../roles/check_services
+
+- name: Ensure all web-servers have fresh TLS certificates
+  hosts: web-servers
+  remote_user: ansible
+  
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  
+  roles:
+    # Pull certificates from cert_proxy and distribute them among the servers
+    - ../roles/update_certificates
diff --git a/roles/update_certificates/tasks/main.yaml b/roles/update_certificates/tasks/main.yaml
new file mode 100644
index 0000000..496a6ce
--- /dev/null
+++ b/roles/update_certificates/tasks/main.yaml
@@ -0,0 +1,20 @@
+---
+- name: Fetch all certificates from cert-proxy
+  ansible.builtin.fetch:
+    src: /tmp/letsencrypt
+    dest: /tmp
+    when: "{{ inventory_hostname == 'cert-proxy' }}"
+
+- name: Push loki.vmn.su certificate to the target
+  ansible.builtin.copy:
+    src: /tmp/letsencrypt/live/loki.vmn.su/fullchain.pem
+    dest: /etc/nginx/certs/loki_fullchain.pem
+    local_follow: true
+    when: "{{ inventory_hostname == 'monitoring' }}"
+
+- name: Push loki.vmn.su key to the target
+  ansible.builtin.copy:
+    src: /tmp/letsencrypt/live/loki.vmn.su/privkey.pem
+    dest: /etc/nginx/certs/loki_privkey.pem
+    local_follow: true
+    when: "{{ inventory_hostname == 'monitoring' }}"