ssl: configure sudo

Signed-off-by: Mattia Rizzolo <mattia@debian.org>

roles/ssl-keys/tasks/common.yml

@@ -41,3 +41,12 @@
     force: no
     owner: root
     group: ssl-cert
+
+- name: configure sudo so cron can renew certs by itself
+  template:
+    src: sudoers
+    dest: /etc/sudoers.d/ssl
+    owner: root
+    group: root
+    mode: 0440
+    validate: visudo -cf %s

roles/ssl-keys/templates/sudoers

+# the SSL auto-renew client should be able to reload services on its own
+ssl-keys ALL=(root) NOPASSWD: /usr/sbin/apache2ctl graceful
+ssl-keys ALL=(root) NOPASSWD: /usr/sbin/service nginx reload
+ssl-keys ALL=(root) NOPASSWD: /usr/sbin/service postfix reload