From 1ec4345e43e3f3a068e93fe864efee35e2e6e503 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ebbe=20Ba=C3=9F?= Date: Fri, 17 Jul 2026 08:34:37 +0200 Subject: [PATCH] fixed permission issue with cert --- .../deploy_collabora_code.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml index 434402c..7011f86 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml @@ -118,7 +118,13 @@ -out {{ cc_ssl_cert }} -subj "/CN={{ collabora_code_domain }}/O=Office/C=DE" -addext "subjectAltName=DNS:{{ collabora_code_domain }}" - creates: "{{ cc_ssl_cert }}" + # IMPORTANT: guard on the KEY, not the cert. openssl req writes both + # files in one command, but if a previous run died/was interrupted + # after writing the .crt and before (or while) writing the .key, + # a `creates` check on the .crt alone causes Ansible to skip + # regenerating the pair on every subsequent run - leaving a cert + # with no matching (or unreadable/empty) key on disk. + creates: "{{ cc_ssl_key }}" - name: Restrict private key permissions ansible.builtin.file: @@ -166,7 +172,6 @@ ProxyPreserveHost On - # cert is issued for collaboraonline.example.com and we proxy to localhost SSLProxyVerify None SSLProxyCheckPeerCN Off @@ -223,6 +228,11 @@ args: creates: /etc/apache2/sites-enabled/collabora.conf + - name: Validate Apache configuration before restart + ansible.builtin.command: apache2ctl configtest + register: apache_configtest + changed_when: false + - name: Restart Apache to apply changes ansible.builtin.service: name: apache2