Use self-signed cert when web server is not reachable

Also fix some punycode niggles

1 files changed, 8 insertions, 0 deletions

diff --git a/infrastructure/roles/web/tasks/main.yaml b/infrastructure/roles/web/tasks/main.yaml
index 92bb88f..f9c722a 100644
--- a/infrastructure/roles/web/tasks/main.yaml
+++ b/infrastructure/roles/web/tasks/main.yaml
@@ -30,12 +30,20 @@
   ansible.builtin.copy:
     dest: /etc/apache2/sites-enabled/ssl.conf
     content: |
+      {% if web_server_reachable %}
       MDomain {{ public_hostname_punycode }}
       MDCertificateAgreement accepted
+      {% endif %}
 
       <VirtualHost *:443>
         ServerName {{ public_hostname_punycode }}
         SSLEngine on
+
+      {% if not web_server_reachable %}
+        SSLCertificateFile "/etc/ssl/certs/ssl-cert-snakeoil.pem"
+        SSLCertificateKeyFile "/etc/ssl/private/ssl-cert-snakeoil.key"
+      {% endif %}
+
         ServerAdmin {{ admin_email }}
 
         <Location /vaultwarden/>