From 23f593aaaf88a934a7d68db49d8ffd0af180464f Mon Sep 17 00:00:00 2001
From: Ryan Faircloth <rfaircloth@splunk.com>
Date: Tue, 16 Jan 2018 17:37:00 +0000
Subject: [PATCH] Fixes #39 adding new script for webroot Fixes #41 support
 deployhook (webroot only) Fixes #41 support for test CA

---
 defaults/main.yml             | 10 ++++++++++
 tasks/create-cert-webroot.yml | 22 ++++++++++++++++++++++
 tasks/main.yml                |  8 ++++++++
 3 files changed, 40 insertions(+)
 create mode 100644 tasks/create-cert-webroot.yml

diff --git a/defaults/main.yml b/defaults/main.yml
index 02134ba..9448de9 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -5,6 +5,9 @@ certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
 certbot_auto_renew_hour: "3"
 certbot_auto_renew_minute: "30"
 certbot_auto_renew_options: "--quiet --no-self-upgrade"
+certbot_testmode: false
+certbot_hsts: false
+
 
 # Parameters used when creating new Certbot certs.
 certbot_create_if_missing: false
@@ -19,6 +22,8 @@ certbot_certs: []
 #     - example3.com
 certbot_create_command: >-
   {{ certbot_script }} certonly --standalone --noninteractive --agree-tos
+  --{{ certbot_create_method  }} {{ certbot_webroot_arg if certbot_create_method == 'webroot'  else '' }}  {{ '--hsts' if certbot_hsts else '' }}
+  {{ '--test-cert' if certbot_testmode else '' }}
   --email {{ cert_item.email | default(certbot_admin_email) }}
   -d {{ cert_item.domains | join(',') }}
   {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
@@ -43,3 +48,8 @@ certbot_keep_updated: true
 
 # Where to put Certbot when installing from source.
 certbot_dir: /opt/certbot
+
+# Where the web root is
+certbot_webroot: "/var/www/html"
+certbot_webroot_arg: "-w {{ certbot_webroot }}"
+
diff --git a/tasks/create-cert-webroot.yml b/tasks/create-cert-webroot.yml
new file mode 100644
index 0000000..5b5e946
--- /dev/null
+++ b/tasks/create-cert-webroot.yml
@@ -0,0 +1,22 @@
+---
+- name: Check if certificate already exists.
+  stat:
+    path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem
+  register: letsencrypt_cert
+
+- name: Create deploy hook
+  copy:
+    content: "{{ certbot_deployhook }}"
+    dest: /etc/letsencrypt/renewal-hooks/deploy/ansible.sh
+    mode: u+rwx
+  run_once: yes
+  when: certbot_deployhook is defined
+
+- debug:
+    var: certbot_create_command
+    verbosity: 2
+
+- name: Generate new certificate if one doesn't exist.
+  shell: "{{ certbot_create_command }}"
+  when: not letsencrypt_cert.stat.exists
+
diff --git a/tasks/main.yml b/tasks/main.yml
index acd2426..894143c 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -21,5 +21,13 @@
   loop_control:
     loop_var: cert_item
 
+- include_tasks: create-cert-webroot.yml
+  with_items: "{{ certbot_certs }}"
+  when:
+    - certbot_create_if_missing
+    - certbot_create_method == 'webroot'
+  loop_control:
+    loop_var: cert_item
+
 - import_tasks: renew-cron.yml
   when: certbot_auto_renew