From b935db607ef8b18c62b4b153ec286fec616c8f3f Mon Sep 17 00:00:00 2001
From: Ryan Faircloth <rfaircloth@splunk.com>
Date: Tue, 16 Jan 2018 17:37:00 +0000
Subject: [PATCH] Fixes #39 adding new script for webroot Fixes #41 support
 deployhook (webroot only) Fixes #41 support for test CA

---
 defaults/main.yml             | 10 +++++++++-
 tasks/create-cert-webroot.yml | 22 ++++++++++++++++++++++
 tasks/main.yml                |  8 ++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 tasks/create-cert-webroot.yml

diff --git a/defaults/main.yml b/defaults/main.yml
index 2e79029..9d348d3 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -5,6 +5,9 @@ certbot_auto_renew_user: "{{ ansible_user }}"
 certbot_auto_renew_hour: 3
 certbot_auto_renew_minute: 30
 certbot_auto_renew_options: "--quiet --no-self-upgrade"
+certbot_testmode: false
+certbot_hsts: false
+
 
 # Parameters used when creating new Certbot certs.
 certbot_create_if_missing: no
@@ -17,7 +20,7 @@ certbot_certs: []
   #     - example2.com
   # - domains:
   #     - example3.com
-certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
+certbot_create_command: "{{ certbot_script }} certonly --{{ certbot_create_method  }} {{ certbot_webroot_arg if certbot_create_method == 'webroot'  else '' }}  {{ '--hsts' if certbot_hsts else '' }} {{ '--test-cert' if certbot_testmode else '' }} --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }} {{ '--deploy-hook /etc/letsencrypt/renewal-hooks/deploy/ansible.sh' if certbot_deployhook is defined else '' }}"
 certbot_create_standalone_stop_services:
   - nginx
   # - apache
@@ -32,3 +35,8 @@ certbot_keep_updated: yes
 
 # Where to put Certbot when installing from source.
 certbot_dir: /opt/certbot
+
+#where the web root is
+certbot_webroot: "/var/www/html"
+certbot_webroot_arg: "-w {{ certbot_webroot }}"
+
diff --git a/tasks/create-cert-webroot.yml b/tasks/create-cert-webroot.yml
new file mode 100644
index 0000000..5b5e946
--- /dev/null
+++ b/tasks/create-cert-webroot.yml
@@ -0,0 +1,22 @@
+---
+- name: Check if certificate already exists.
+  stat:
+    path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem
+  register: letsencrypt_cert
+
+- name: Create deploy hook
+  copy:
+    content: "{{ certbot_deployhook }}"
+    dest: /etc/letsencrypt/renewal-hooks/deploy/ansible.sh
+    mode: u+rwx
+  run_once: yes
+  when: certbot_deployhook is defined
+
+- debug:
+    var: certbot_create_command
+    verbosity: 2
+
+- name: Generate new certificate if one doesn't exist.
+  shell: "{{ certbot_create_command }}"
+  when: not letsencrypt_cert.stat.exists
+
diff --git a/tasks/main.yml b/tasks/main.yml
index 680aeda..5e488d9 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -15,5 +15,13 @@
   loop_control:
     loop_var: cert_item
 
+- include_tasks: create-cert-webroot.yml
+  with_items: "{{ certbot_certs }}"
+  when:
+    - certbot_create_if_missing
+    - certbot_create_method == 'webroot'
+  loop_control:
+    loop_var: cert_item
+
 - import_tasks: renew-cron.yml
   when: certbot_auto_renew