create method dns and staging server - 1st release

tasks/create-cert-dns-plugin.yml

@@ -0,0 +1,64 @@
+---
+- name: Check if certificate already exists.
+  stat:
+    path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem
+  register: letsencrypt_cert
+
+- name: Ensure pre,post,deploy hook folders exist.
+  file:
+    path: /etc/letsencrypt/renewal-hooks/{{ item }}
+    state: directory
+    mode: 0755
+    owner: root
+    group: root
+  with_items:
+    - deploy
+
+- name: Create deploy hook to execute tasks post cert generatation.
+  template:
+    src: renew_hook.j2
+    dest: /etc/letsencrypt/renewal-hooks/deploy/renew_hook.sh
+    owner: root
+    group: root
+    mode: 0750
+  when:
+    - certbot_create_dns_renew_hook_services is defined
+
+- name: "Create DNS RFC {{ certbot_dns_plugin }} Credentials File."
+  template:
+    src: dns_plugin_credentials.j2
+    dest: "{{certbot_dns_credentials_file}}"
+    owner: root
+    group: root
+    mode: 0600
+  when:
+    - certbot_dns_plugin is in certbot_supported_dns_plugins
+
+- name: Upload custom dns credential file
+  copy:
+    src: "{{ certbot_dns_credentials_custom_file  }}"
+    dest: "{{ certbot_dns_credentials_file }}"
+    state: file
+    mode: 0600
+    owner: root
+    group: root
+  when:
+    - certbot_dns_plugin != 'rfc2136'
+    - certbot_dns_credentials_custom_file is defined
+  
+- name: Generate new certificate if one doesn't exist.
+  command: "{{ certbot_dns_create_command }}"
+  when: not letsencrypt_cert.stat.exists
+
+- name: Assemble certificate crt and key into pem file for haproxy
+  assemble:
+    dest: "/etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/{{ cert_item.domains | first | replace('*.', '') }}-haproxy.pem"
+    src: "/etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/"
+    regexp: '(fullchain.pem|privkey.pem)'
+    remote_src: yes
+    owner: root
+    group: root
+    mode: '0600'
+  when: 
+    - not letsencrypt_cert.stat.exists 
+    - ('haproxy' is in certbot_create_dns_renew_hook_services)|bool

tasks/install-with-snap.yml

@@ -35,6 +35,17 @@
     dest: /usr/bin/certbot
     state: link
 
+- name: Make sure certbot Trust Plugins With Root is set.
+  command: snap set certbot trust-plugin-with-root=ok
+  when: 
+    - certbot_dns_plugin is defined
+
+- name: Install DNS Plugin - {{ certbot_dns_plugin }}.
+  snap:
+    name: "certbot-dns-{{certbot_dns_plugin}}"
+    classic: true
+  when: certbot_dns_plugin is defined
+
 - name: Set Certbot script variable.
   set_fact:
     certbot_script: /usr/bin/certbot

tasks/main.yml

@@ -21,5 +21,13 @@
   loop_control:
     loop_var: cert_item
 
+- include_tasks: create-cert-dns-plugin.yml
+  with_items: "{{ certbot_certs }}"
+  when:
+    - certbot_create_if_missing
+    - certbot_create_method == 'dns'
+  loop_control:
+    loop_var: cert_item
+
 - import_tasks: renew-cron.yml
   when: certbot_auto_renew