Daniel Allaire
ca0f95da28
serveurs_* -> serveur_, clients_ -> client_, suffixes pluriels au singulier (serveur_web_dorsal/frontal, client_metrique, client_journal). Renommage par tokens exacts : repertoires de roles, playbooks de groupes, group_vars, variables internes des roles (serveur_nginx_*, conformite ansible-lint), groupes du plan, constantes de code, docs. Faux-amis preserves (serveurs_bd, scripts/serveurs.py, fonctions Python). Groupes d'etat gardes au pluriel (hotes_actifs/planifies, modeles_vm). Valide : ansible-lint 0 echec (0 var-naming), diff vide de la generation, node --check, tous les registres. Ajout de .ansible-lint excluant docs/ (registres de donnees, pas du contenu Ansible). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
770 B
Django/Jinja
20 lines
770 B
Django/Jinja
# Gere par Set-OPS (role client_pki). Renouvellement de certificat (Smallstep).
|
|
[Unit]
|
|
Description=Certificate renewer for %I
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
Documentation=https://smallstep.com/docs/step-ca/renewal
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=root
|
|
Environment=STEPPATH={{ client_pki_steppath }}
|
|
Environment=CERT_LOCATION={{ client_pki_steppath }}/certs/%i.crt
|
|
Environment=KEY_LOCATION={{ client_pki_steppath }}/certs/%i.key
|
|
ExecCondition=/usr/bin/step certificate needs-renewal ${CERT_LOCATION}
|
|
ExecStart=/usr/bin/step ca renew --force ${CERT_LOCATION} ${KEY_LOCATION}
|
|
ExecStartPost=/usr/bin/env sh -c "! systemctl --quiet is-active %i.service || systemctl try-reload-or-restart %i"
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|