diff --git a/defaults/main.yml b/defaults/main.yml index 02134ba..9448de9 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -5,6 +5,9 @@ certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}" certbot_auto_renew_hour: "3" certbot_auto_renew_minute: "30" certbot_auto_renew_options: "--quiet --no-self-upgrade" +certbot_testmode: false +certbot_hsts: false + # Parameters used when creating new Certbot certs. certbot_create_if_missing: false @@ -19,6 +22,8 @@ certbot_certs: [] # - example3.com certbot_create_command: >- {{ certbot_script }} certonly --standalone --noninteractive --agree-tos + --{{ certbot_create_method }} {{ certbot_webroot_arg if certbot_create_method == 'webroot' else '' }} {{ '--hsts' if certbot_hsts else '' }} + {{ '--test-cert' if certbot_testmode else '' }} --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }} {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services' @@ -43,3 +48,8 @@ certbot_keep_updated: true # Where to put Certbot when installing from source. certbot_dir: /opt/certbot + +# Where the web root is +certbot_webroot: "/var/www/html" +certbot_webroot_arg: "-w {{ certbot_webroot }}" + diff --git a/tasks/create-cert-webroot.yml b/tasks/create-cert-webroot.yml new file mode 100644 index 0000000..5b5e946 --- /dev/null +++ b/tasks/create-cert-webroot.yml @@ -0,0 +1,22 @@ +--- +- name: Check if certificate already exists. + stat: + path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem + register: letsencrypt_cert + +- name: Create deploy hook + copy: + content: "{{ certbot_deployhook }}" + dest: /etc/letsencrypt/renewal-hooks/deploy/ansible.sh + mode: u+rwx + run_once: yes + when: certbot_deployhook is defined + +- debug: + var: certbot_create_command + verbosity: 2 + +- name: Generate new certificate if one doesn't exist. + shell: "{{ certbot_create_command }}" + when: not letsencrypt_cert.stat.exists + diff --git a/tasks/main.yml b/tasks/main.yml index acd2426..894143c 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -21,5 +21,13 @@ loop_control: loop_var: cert_item +- include_tasks: create-cert-webroot.yml + with_items: "{{ certbot_certs }}" + when: + - certbot_create_if_missing + - certbot_create_method == 'webroot' + loop_control: + loop_var: cert_item + - import_tasks: renew-cron.yml when: certbot_auto_renew