diff --git a/defaults/main.yml b/defaults/main.yml index 662a8c7..89528d7 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -47,10 +47,10 @@ certbot_create_command: >- -d {{ cert_item.domains | join(',') }} {{ '--expand' if certbot_expand else '' }} {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services' - if certbot_create_standalone_stop_services and certbot_create_method == 'standalone' + if certbot_create_standalone_stop_services and certbot_create_method in ['standalone', 'nginx'] else '' }} {{ '--post-hook /etc/letsencrypt/renewal-hooks/post/start_services' - if certbot_create_standalone_stop_services and certbot_create_method == 'standalone' + if certbot_create_standalone_stop_services and certbot_create_method in ['standalone', 'nginx'] else '' }} {{ "--deploy-hook '" ~ cert_item.deploy_hook ~ "'" if 'deploy_hook' in cert_item diff --git a/tasks/create-cert-nginx.yml b/tasks/create-cert-nginx.yml index 3585822..594e6c8 100644 --- a/tasks/create-cert-nginx.yml +++ b/tasks/create-cert-nginx.yml @@ -9,7 +9,57 @@ register: letsencrypt_cert become: true +- name: Ensure pre and post hook folders exist. + file: + path: /etc/letsencrypt/renewal-hooks/{{ item }} + state: directory + mode: 0755 + owner: root + group: root + with_items: + - pre + - post + +- name: Create pre hook to stop services. + template: + src: stop_services.j2 + dest: /etc/letsencrypt/renewal-hooks/pre/stop_services + owner: root + group: root + mode: 0750 + when: + - certbot_create_standalone_stop_services is defined + - certbot_create_standalone_stop_services is truthy + +- name: Create post hook to start services. + template: + src: start_services.j2 + dest: /etc/letsencrypt/renewal-hooks/post/start_services + owner: root + group: root + mode: 0750 + when: + - certbot_create_standalone_stop_services is defined + - certbot_create_standalone_stop_services is truthy + +- name: Check if domains have changed + block: + - name: Register certificate domains + shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2" + changed_when: false + register: letsencrypt_cert_domains_dirty + + - name: Cleanup domain list + set_fact: + letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}" + + - name: Determine if domains have changed + set_fact: + letsencrypt_cert_domains_changed: "{{ letsencrypt_cert_domains != (cert_item.domains | map('trim') | select('!=', '') | list | sort) }}" + + when: letsencrypt_cert.stat.exists + - name: Generate new certificate if one doesn't exist. command: "{{ certbot_create_command }}" - when: not letsencrypt_cert.stat.exists + when: not letsencrypt_cert.stat.exists or letsencrypt_cert_domains_changed | default(false) become: true