From 574c0843c8620f299ff67acbf35c9a6aa45121d0 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Tue, 31 Oct 2017 10:09:41 -0500
Subject: [PATCH 01/17] Fixes #37: Make renew command configurable.

---
 README.md            | 1 +
 defaults/main.yml    | 1 +
 tasks/renew-cron.yml | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 5c04cf7..5bce80b 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,7 @@ The variable `certbot_install_from_source` controls whether to install Certbot f
     certbot_auto_renew_user: "{{ ansible_user }}"
     certbot_auto_renew_hour: 3
     certbot_auto_renew_minute: 30
+    certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
 
diff --git a/defaults/main.yml b/defaults/main.yml
index 7f6f0d3..395b47d 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -4,6 +4,7 @@ certbot_auto_renew: true
 certbot_auto_renew_user: "{{ ansible_user }}"
 certbot_auto_renew_hour: 3
 certbot_auto_renew_minute: 30
+certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 # To install from source (on older OSes or if you need a specific or newer
 # version of Certbot), set this variable to `yes` and configure other options.
diff --git a/tasks/renew-cron.yml b/tasks/renew-cron.yml
index 7678a7c..394a30e 100644
--- a/tasks/renew-cron.yml
+++ b/tasks/renew-cron.yml
@@ -2,7 +2,7 @@
 - name: Add cron job for certbot renewal (if configured).
   cron:
     name: Certbot automatic renewal.
-    job: "{{ certbot_script }} renew --quiet --no-self-upgrade"
+    job: "{{ certbot_script }} renew {{ certbot_auto_renew_options }}"
     minute: "{{ certbot_auto_renew_minute }}"
     hour: "{{ certbot_auto_renew_hour }}"
     user: "{{ certbot_auto_renew_user }}"

From 7651f0ac0b67dd59f158f585bfae99c8cb735477 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Wed, 6 Dec 2017 22:48:30 -0600
Subject: [PATCH 02/17] Issue #12: Add basic standalone certbot cert
 generation.

---
 defaults/main.yml                | 16 ++++++++++++++++
 tasks/create-cert-standalone.yml | 23 +++++++++++++++++++++++
 tasks/main.yml                   |  4 ++++
 tests/test-nginx-aws.yml         | 28 ++++++++++++++++++++++++++++
 4 files changed, 71 insertions(+)
 create mode 100644 tasks/create-cert-standalone.yml
 create mode 100644 tests/test-nginx-aws.yml

diff --git a/defaults/main.yml b/defaults/main.yml
index 395b47d..a415375 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -6,6 +6,22 @@ certbot_auto_renew_hour: 3
 certbot_auto_renew_minute: 30
 certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
+# Parameters used when creating new Certbot certs.
+certbot_admin_email: email@example.com
+certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ item.email | default(certbot_admin_email) }} -d {{ item.domains | join(',') }}"
+certbot_create_if_missing: no
+certbot_create_stop_services:
+  - nginx
+  # - apache
+  # - varnish
+certbot_certs: []
+  # - email: janedoe@example.com
+  #   domains:
+  #     - example1.com
+  #     - example2.com
+  # - domains:
+  #     - example3.com
+
 # To install from source (on older OSes or if you need a specific or newer
 # version of Certbot), set this variable to `yes` and configure other options.
 certbot_install_from_source: no
diff --git a/tasks/create-cert-standalone.yml b/tasks/create-cert-standalone.yml
new file mode 100644
index 0000000..f172774
--- /dev/null
+++ b/tasks/create-cert-standalone.yml
@@ -0,0 +1,23 @@
+---
+- name: Check if certificate already exists.
+  stat:
+    path: /etc/letsencrypt/live/{{ item.domains | first }}/cert.pem
+  register: letsencrypt_cert
+
+- name: Stop services to allow certbot to generate a cert.
+  service:
+    name: "{{ item }}"
+    state: stopped
+  when: not letsencrypt_cert.stat.exists
+  with_items: certbot_create_stop_services
+
+- name: Generate new certificate if one doesn't exist.
+  shell: "{{ certbot_create_command }}"
+  when: not letsencrypt_cert.stat.exists
+
+- name: Start services after cert has been generated.
+  service:
+    name: "{{ item }}"
+    state: started
+  when: not letsencrypt_cert.stat.exists
+  with_items: certbot_create_stop_services
diff --git a/tasks/main.yml b/tasks/main.yml
index 5324ff9..ed1ffef 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -7,5 +7,9 @@
 - include: install-from-source.yml
   when: certbot_install_from_source
 
+- include: create-cert-standalone.yml
+  with_items: "{{ certbot_certs }}"
+  when: certbot_create_if_missing
+
 - include: renew-cron.yml
   when: certbot_auto_renew
diff --git a/tests/test-nginx-aws.yml b/tests/test-nginx-aws.yml
new file mode 100644
index 0000000..92eca60
--- /dev/null
+++ b/tests/test-nginx-aws.yml
@@ -0,0 +1,28 @@
+---
+- hosts: all
+
+  vars:
+    certbot_admin_email: https@servercheck.in
+    certbot_create_if_missing: yes
+    certbot_create_stop_services:
+      - nginx
+    certbot_certs:
+      - domains:
+          - certbot-test.servercheck.in
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_os_family == 'Debian'
+      changed_when: false
+
+    - name: Install cron (RedHat).
+      yum: name=cronie state=present
+      when: ansible_os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - role_under_test

From 5f7c9e046c791e1c9fcc3a16593106af42f4a9bc Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Sun, 10 Dec 2017 22:47:54 -0600
Subject: [PATCH 03/17] Issue #12: Fix standalone cert generation, add full
 build-test-teardown playbook.

---
 README.md                           |   4 +
 defaults/main.yml                   |   2 +-
 tasks/create-cert-standalone.yml    |   6 +-
 tasks/main.yml                      |   2 +
 tests/requirements.yml              |   1 +
 tests/test-nginx-aws.yml            |  28 -----
 tests/test-standalone-nginx-aws.yml | 178 ++++++++++++++++++++++++++++
 tests/test.yml                      |   7 +-
 8 files changed, 194 insertions(+), 34 deletions(-)
 delete mode 100644 tests/test-nginx-aws.yml
 create mode 100644 tests/test-standalone-nginx-aws.yml

diff --git a/README.md b/README.md
index 5bce80b..bd6106e 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,10 @@ The variable `certbot_install_from_source` controls whether to install Certbot f
 
 By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
 
+### Automatic Certificate Generation
+
+TODO: Add new variables and documentation here.
+
 ### Source Installation from Git
 
 You can install Certbot from it's Git source repository if desired. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).
diff --git a/defaults/main.yml b/defaults/main.yml
index a415375..f2e8719 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -8,7 +8,7 @@ certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 # Parameters used when creating new Certbot certs.
 certbot_admin_email: email@example.com
-certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ item.email | default(certbot_admin_email) }} -d {{ item.domains | join(',') }}"
+certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
 certbot_create_if_missing: no
 certbot_create_stop_services:
   - nginx
diff --git a/tasks/create-cert-standalone.yml b/tasks/create-cert-standalone.yml
index f172774..749c1e1 100644
--- a/tasks/create-cert-standalone.yml
+++ b/tasks/create-cert-standalone.yml
@@ -1,7 +1,7 @@
 ---
 - name: Check if certificate already exists.
   stat:
-    path: /etc/letsencrypt/live/{{ item.domains | first }}/cert.pem
+    path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem
   register: letsencrypt_cert
 
 - name: Stop services to allow certbot to generate a cert.
@@ -9,7 +9,7 @@
     name: "{{ item }}"
     state: stopped
   when: not letsencrypt_cert.stat.exists
-  with_items: certbot_create_stop_services
+  with_items: "{{ certbot_create_stop_services }}"
 
 - name: Generate new certificate if one doesn't exist.
   shell: "{{ certbot_create_command }}"
@@ -20,4 +20,4 @@
     name: "{{ item }}"
     state: started
   when: not letsencrypt_cert.stat.exists
-  with_items: certbot_create_stop_services
+  with_items: "{{ certbot_create_stop_services }}"
diff --git a/tasks/main.yml b/tasks/main.yml
index ed1ffef..466def7 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -10,6 +10,8 @@
 - include: create-cert-standalone.yml
   with_items: "{{ certbot_certs }}"
   when: certbot_create_if_missing
+  loop_control:
+    loop_var: cert_item
 
 - include: renew-cron.yml
   when: certbot_auto_renew
diff --git a/tests/requirements.yml b/tests/requirements.yml
index 6208520..0b31312 100644
--- a/tests/requirements.yml
+++ b/tests/requirements.yml
@@ -1,2 +1,3 @@
 ---
 - src: geerlingguy.git
+- src: geerlingguy.nginx
diff --git a/tests/test-nginx-aws.yml b/tests/test-nginx-aws.yml
deleted file mode 100644
index 92eca60..0000000
--- a/tests/test-nginx-aws.yml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-- hosts: all
-
-  vars:
-    certbot_admin_email: https@servercheck.in
-    certbot_create_if_missing: yes
-    certbot_create_stop_services:
-      - nginx
-    certbot_certs:
-      - domains:
-          - certbot-test.servercheck.in
-
-  pre_tasks:
-    - name: Update apt cache.
-      apt: update_cache=yes cache_valid_time=600
-      when: ansible_os_family == 'Debian'
-      changed_when: false
-
-    - name: Install cron (RedHat).
-      yum: name=cronie state=present
-      when: ansible_os_family == 'RedHat'
-
-    - name: Install cron (Debian).
-      apt: name=cron state=present
-      when: ansible_os_family == 'Debian'
-
-  roles:
-    - role_under_test
diff --git a/tests/test-standalone-nginx-aws.yml b/tests/test-standalone-nginx-aws.yml
new file mode 100644
index 0000000..6916171
--- /dev/null
+++ b/tests/test-standalone-nginx-aws.yml
@@ -0,0 +1,178 @@
+---
+# To run:
+#   1. Ensure Ansible and Boto are installed (pip install ansible boto).
+#   2. Ensure you have AWS credentials stored where Boto can find them, and they
+#      are under the profile 'mm'.
+#   3. Ensure you have a pubkey available at ~/.ssh/id_rsa.pub.
+#   3. Run the playbook: ansible-playbook test-standalone-nginx-aws.yml
+
+# Play 1: Provision EC2 instance and A record.
+- hosts: localhost
+  connection: local
+  gather_facts: no
+
+  tasks:
+    - name: Configure EC2 Security Group.
+      ec2_group:
+        profile: mm
+        name: certbot_test_http
+        description: HTTP security group for Certbot testing.
+        region: "us-east-1"
+        state: present
+        rules:
+          - proto: tcp
+            from_port: 80
+            to_port: 80
+            cidr_ip: 0.0.0.0/0
+          - proto: tcp
+            from_port: 443
+            to_port: 443
+            cidr_ip: 0.0.0.0/0
+          - proto: tcp
+            from_port: 22
+            to_port: 22
+            cidr_ip: 0.0.0.0/0
+        rules_egress: []
+
+    - name: Add EC2 Key Pair.
+      ec2_key:
+        profile: mm
+        region: "us-east-1"
+        name: certbot_test
+        key_material: "{{ item }}"
+      with_file: ~/.ssh/id_rsa.pub
+
+    - name: Provision EC2 instance.
+      ec2:
+        profile: mm
+        key_name: certbot_test
+        instance_tags:
+          Name: "certbot-standalone-nginx-test"
+        group: ['default', 'certbot_test_http']
+        instance_type: t2.micro
+        image: ami-02e98f78 # CentOS Linux 7 x86_64 HVM EBS
+        region: "us-east-1"
+        wait: yes
+        wait_timeout: 500
+        exact_count: 1
+        count_tag:
+          Name: "certbot-standalone-nginx-test"
+      register: created_instance
+
+    - name: Add A record for the new EC2 instance IP in Route53.
+      route53:
+        profile: mm
+        command: create
+        zone: servercheck.in
+        record: certbot-test.servercheck.in
+        type: A
+        ttl: 300
+        value: "{{ created_instance.tagged_instances.0.public_ip }}"
+        wait: yes
+        overwrite: yes
+
+    - name: Add EC2 instance to inventory groups.
+      add_host:
+        name: "certbot-test.servercheck.in"
+        groups: "aws,aws_nginx"
+        ansible_ssh_user: centos
+        host_key_checking: False
+      when: created_instance.tagged_instances.0.id is defined
+
+# Play 2: Configure EC2 instance with Certbot and Nginx.
+- hosts: aws_nginx
+  gather_facts: yes
+  become: yes
+
+  vars:
+    certbot_admin_email: https@servercheck.in
+    certbot_create_if_missing: yes
+    certbot_create_stop_services:
+      - nginx
+    certbot_certs:
+      - domains:
+          - certbot-test.servercheck.in
+    certbot_create_stop_services: []
+    nginx_vhosts:
+      - listen: "443 ssl http2"
+        server_name: "certbot-test.servercheck.in"
+        root: "/usr/share/nginx/html"
+        index: "index.html index.htm"
+        state: "present"
+        template: "{{ nginx_vhost_template }}"
+        filename: "certbot_test.conf"
+        extra_parameters: |
+          ssl_certificate     /etc/letsencrypt/live/certbot-test.servercheck.in/fullchain.pem;
+          ssl_certificate_key /etc/letsencrypt/live/certbot-test.servercheck.in/privkey.pem;
+          ssl_protocols       TLSv1.1 TLSv1.2;
+          ssl_ciphers         HIGH:!aNULL:!MD5;
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_os_family == 'Debian'
+      changed_when: false
+
+    - name: Install dependencies (RedHat).
+      yum: name={{ item }} state=present
+      when: ansible_os_family == 'RedHat'
+      with_items:
+        - cronie
+        - epel-release
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - geerlingguy.certbot
+    - geerlingguy.nginx
+
+  tasks:
+    - name: Flush handlers in case any configs have changed.
+      meta: flush_handlers
+
+    - name: Test secure connection to SSL domain.
+      uri:
+        url: https://certbot-test.servercheck.in/
+        status_code: 200
+      delegate_to: localhost
+      become: no
+
+# Play 3: Tear down EC2 instance and A record.
+- hosts: localhost
+  connection: local
+  gather_facts: no
+
+  tasks:
+    - name: Destroy EC2 instance.
+      ec2:
+        profile: mm
+        instance_ids: ["{{ created_instance.tagged_instances.0.id }}"]
+        region: "us-east-1"
+        state: absent
+        wait: yes
+        wait_timeout: 500
+
+    - name: Delete Security Group.
+      ec2_group:
+        profile: mm
+        name: certbot_test_http
+        region: "us-east-1"
+        state: absent
+
+    - name: Delete Key Pair.
+      ec2_key:
+        profile: mm
+        name: certbot_test
+        region: "us-east-1"
+        state: absent
+
+    - name: Delete Route53 record.
+      route53:
+        profile: mm
+        state: delete
+        zone: servercheck.in
+        record: certbot-test.servercheck.in
+        type: A
+        ttl: 300
diff --git a/tests/test.yml b/tests/test.yml
index 217fc45..a242a3e 100644
--- a/tests/test.yml
+++ b/tests/test.yml
@@ -7,9 +7,12 @@
       when: ansible_os_family == 'Debian'
       changed_when: false
 
-    - name: Install cron (RedHat).
-      yum: name=cronie state=present
+    - name: Install dependencies (RedHat).
+      yum: name={{ item }} state=present
       when: ansible_os_family == 'RedHat'
+      with_items:
+        - cronie
+        - epel-release
 
     - name: Install cron (Debian).
       apt: name=cron state=present

From d3f98e4258502556a0537c7ef2978a38d86d23ca Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Mon, 11 Dec 2017 22:17:25 -0600
Subject: [PATCH 04/17] Fixes #12: Document how to generate certs automatically
 using certbot --standalone.

---
 README.md                           | 52 +++++++++++++++++++++++++----
 defaults/main.yml                   | 13 ++++----
 tasks/create-cert-standalone.yml    |  4 +--
 tasks/main.yml                      | 14 ++++----
 tests/test-standalone-nginx-aws.yml |  6 ++--
 5 files changed, 65 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index bd6106e..84e16b2 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,41 @@ By default, this role configures a cron job to run under the provided user accou
 
 ### Automatic Certificate Generation
 
-TODO: Add new variables and documentation here.
+Currently there is one built-in method for generating new certificates using this role: `standalone`. Other methods (e.g. using nginx or apache and a webroot) may be added in the future.
+
+**For a complete example**: see the fully functional test playbook in [tests/test-standalone-nginx-aws.yml](tests/test-standalone-nginx-aws.yml).
+
+    certbot_create_if_missing: no
+    certbot_create_method: standalone
+
+Set `certbot_create_if_missing` to `yes` or `True` to let this role generate certs. Set the method used for generating certs with the `certbot_create_method` variable—current allowed values include: `standalone`.
+
+    certbot_admin_email: email@example.com
+
+The email address used to agree to Let's Encrypt's TOS and subscribe to cert-related notifications. This should be customized and set to an email address that you or your organization regularly monitors.
+
+    certbot_certs: []
+      # - email: janedoe@example.com
+      #   domains:
+      #     - example1.com
+      #     - example2.com
+      # - domains:
+      #     - example3.com
+
+A list of domains (and other data) for which certs should be generated. You can add an `email` key to any list item to override the `certbot_admin_email`.
+
+    certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
+
+The `certbot_create_command` defines the command used to generate the cert.
+
+#### Standalone Certificate Generation
+
+    certbot_create_standalone_stop_services:
+      - nginx
+
+Services that should be stopped while `certbot` runs it's own standalone server on ports 80 and 443. If you're running Apache, set this to `apache2` (Ubuntu), or `httpd` (RHEL), or if you have Nginx on port 443 and something else on port 80 (e.g. Varnish, a Java app, or something else), add it to the list so it is stopped when the certificate is generated.
+
+These services will only be stopped the first time a new cert is generated.
 
 ### Source Installation from Git
 
@@ -55,9 +89,13 @@ None.
       roles:
         - geerlingguy.certbot
 
-### Creating certificates with certbot
+See other examples in the `tests/` directory.
 
-After installation, you can create certificates using the `certbot` (or `certbot-auto`) script (use `letsencrypt` on Ubuntu 16.04, or use `/opt/certbot/certbot-auto` if installing from source/Git. Here are some example commands to configure certificates with Certbot:
+### Manually creating certificates with certbot
+
+_Note: You can have this role automatically generate certificates; see the "Automatic Certificate Generation" documentation above._
+
+You can manually create certificates using the `certbot` (or `certbot-auto`) script (use `letsencrypt` on Ubuntu 16.04, or use `/opt/certbot/certbot-auto` if installing from source/Git. Here are some example commands to configure certificates with Certbot:
 
     # Automatically add certs for all Apache virtualhosts (use with caution!).
     certbot --apache
@@ -65,15 +103,15 @@ After installation, you can create certificates using the `certbot` (or `certbot
     # Generate certs, but don't modify Apache configuration (safer).
     certbot --apache certonly
 
-If you want to fully automate the process of adding a new certificate, you can do so using the command line options to register, accept the terms of service, and then generate a cert using the standalone server:
+If you want to fully automate the process of adding a new certificate, but don't want to use this role's built in functionality, you can do so using the command line options to register, accept the terms of service, and then generate a cert using the standalone server:
 
-  1. Make sure any services listening on port 80 (Apache, Nginx, Varnish, etc.) are stopped.
+  1. Make sure any services listening on ports 80 and 443 (Apache, Nginx, Varnish, etc.) are stopped.
   2. Register with something like `certbot register --agree-tos --email [your-email@example.com]`
     - Note: You won't need to do this step in the future, when generating additional certs on the same server.
   3. Generate a cert for a domain whose DNS points to this server: `certbot certonly --noninteractive --standalone -d example.com -d www.example.com`
-  4. Re-start whatever was listening on port 80 before.
+  4. Re-start whatever was listening on ports 80 and 443 before.
   5. Update your webserver's virtualhost TLS configuration to point at the new certificate (`fullchain.pem`) and private key (`privkey.pem`) Certbot just generated for the domain you passed in the `certbot` command.
-  6. Restart your webserver so it uses the new HTTPS virtualhost configuration.
+  6. Reload or restart your webserver so it uses the new HTTPS virtualhost configuration.
 
 ### Certbot certificate auto-renewal
 
diff --git a/defaults/main.yml b/defaults/main.yml
index f2e8719..2e79029 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -7,13 +7,9 @@ certbot_auto_renew_minute: 30
 certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 # Parameters used when creating new Certbot certs.
-certbot_admin_email: email@example.com
-certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
 certbot_create_if_missing: no
-certbot_create_stop_services:
-  - nginx
-  # - apache
-  # - varnish
+certbot_create_method: standalone
+certbot_admin_email: email@example.com
 certbot_certs: []
   # - email: janedoe@example.com
   #   domains:
@@ -21,6 +17,11 @@ certbot_certs: []
   #     - example2.com
   # - domains:
   #     - example3.com
+certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
+certbot_create_standalone_stop_services:
+  - nginx
+  # - apache
+  # - varnish
 
 # To install from source (on older OSes or if you need a specific or newer
 # version of Certbot), set this variable to `yes` and configure other options.
diff --git a/tasks/create-cert-standalone.yml b/tasks/create-cert-standalone.yml
index 749c1e1..b92faec 100644
--- a/tasks/create-cert-standalone.yml
+++ b/tasks/create-cert-standalone.yml
@@ -9,7 +9,7 @@
     name: "{{ item }}"
     state: stopped
   when: not letsencrypt_cert.stat.exists
-  with_items: "{{ certbot_create_stop_services }}"
+  with_items: "{{ certbot_create_standalone_stop_services }}"
 
 - name: Generate new certificate if one doesn't exist.
   shell: "{{ certbot_create_command }}"
@@ -20,4 +20,4 @@
     name: "{{ item }}"
     state: started
   when: not letsencrypt_cert.stat.exists
-  with_items: "{{ certbot_create_stop_services }}"
+  with_items: "{{ certbot_create_standalone_stop_services }}"
diff --git a/tasks/main.yml b/tasks/main.yml
index 466def7..680aeda 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,17 +1,19 @@
 ---
-- include: include-vars.yml
+- import_tasks: include-vars.yml
 
-- include: install-with-package.yml
+- import_tasks: install-with-package.yml
   when: not certbot_install_from_source
 
-- include: install-from-source.yml
+- import_tasks: install-from-source.yml
   when: certbot_install_from_source
 
-- include: create-cert-standalone.yml
+- include_tasks: create-cert-standalone.yml
   with_items: "{{ certbot_certs }}"
-  when: certbot_create_if_missing
+  when:
+    - certbot_create_if_missing
+    - certbot_create_method == 'standalone'
   loop_control:
     loop_var: cert_item
 
-- include: renew-cron.yml
+- import_tasks: renew-cron.yml
   when: certbot_auto_renew
diff --git a/tests/test-standalone-nginx-aws.yml b/tests/test-standalone-nginx-aws.yml
index 6916171..a546169 100644
--- a/tests/test-standalone-nginx-aws.yml
+++ b/tests/test-standalone-nginx-aws.yml
@@ -87,12 +87,10 @@
   vars:
     certbot_admin_email: https@servercheck.in
     certbot_create_if_missing: yes
-    certbot_create_stop_services:
-      - nginx
+    certbot_create_standalone_stop_services: []
     certbot_certs:
       - domains:
           - certbot-test.servercheck.in
-    certbot_create_stop_services: []
     nginx_vhosts:
       - listen: "443 ssl http2"
         server_name: "certbot-test.servercheck.in"
@@ -176,3 +174,5 @@
         record: certbot-test.servercheck.in
         type: A
         ttl: 300
+        # See: https://github.com/ansible/ansible/pull/32297
+        value: []

From c27861fddcc390117bdefae1609695edebd2cc01 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Mon, 11 Dec 2017 22:26:46 -0600
Subject: [PATCH 05/17] Issue #12: New include techniques require Ansible 2.4
 or later. [ci skip]

---
 meta/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/main.yml b/meta/main.yml
index aa00a88..e9b4a60 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -6,7 +6,7 @@ galaxy_info:
   description: "Installs and configures Certbot (for Let's Encrypt)."
   company: "Midwestern Mac, LLC"
   license: "license (BSD, MIT)"
-  min_ansible_version: 2.0
+  min_ansible_version: 2.4
   platforms:
     - name: EL
       versions:

From 3f1a802d71e30f9112dd2422df7a840c9bf4f97e Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Mon, 11 Dec 2017 22:40:31 -0600
Subject: [PATCH 06/17] Fixes #25: Suggest using source install for more
 pleasant experience. [ci skip]

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 84e16b2..5491e28 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,8 @@ Installs and configures Certbot (for Let's Encrypt).
 
 If installing from source, Git is required. You can install Git using the `geerlingguy.git` role.
 
+Generally, installing from source (see section `Source Installation from Git`) leads to a better experience using Certbot and Let's Encrypt, especially if you're using an older OS release.
+
 ## Role Variables
 
 The variable `certbot_install_from_source` controls whether to install Certbot from Git or package management. The latter is the default, so the variable defaults to `no`.

From ce4dacf63209fe26db0ea5f462219359ef4b41ff Mon Sep 17 00:00:00 2001
From: Michael Porter <599168+michaelpporter@users.noreply.github.com>
Date: Sun, 23 Sep 2018 14:58:52 -0500
Subject: [PATCH 07/17] Supports check of wildcard certs

Adds support to check for wildcard certs to not re-make them on subsequent runs
---
 tasks/create-cert-standalone.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tasks/create-cert-standalone.yml b/tasks/create-cert-standalone.yml
index b92faec..65c43bc 100644
--- a/tasks/create-cert-standalone.yml
+++ b/tasks/create-cert-standalone.yml
@@ -1,7 +1,7 @@
 ---
 - name: Check if certificate already exists.
   stat:
-    path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem
+    path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem
   register: letsencrypt_cert
 
 - name: Stop services to allow certbot to generate a cert.

From e14d6eb04a6e93655d44931e4ccf7dde029d03c7 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Wed, 26 Sep 2018 21:25:42 -0500
Subject: [PATCH 08/17] Switch tests to use Molecule.

---
 .gitignore                                    |  3 +-
 .travis.yml                                   | 36 ++++++++++++-------
 molecule/default/molecule.yml                 | 27 ++++++++++++++
 .../default/playbook-source-install.yml       |  8 +++--
 .../default/playbook-standalone-nginx-aws.yml |  0
 .../test.yml => molecule/default/playbook.yml |  6 ++--
 {tests => molecule/default}/requirements.yml  |  0
 molecule/default/tests/test_default.py        | 14 ++++++++
 molecule/default/yaml-lint.yml                |  6 ++++
 tests/README.md                               | 11 ------
 10 files changed, 81 insertions(+), 30 deletions(-)
 create mode 100644 molecule/default/molecule.yml
 rename tests/test-source-install.yml => molecule/default/playbook-source-install.yml (80%)
 rename tests/test-standalone-nginx-aws.yml => molecule/default/playbook-standalone-nginx-aws.yml (100%)
 rename tests/test.yml => molecule/default/playbook.yml (87%)
 rename {tests => molecule/default}/requirements.yml (100%)
 create mode 100644 molecule/default/tests/test_default.py
 create mode 100644 molecule/default/yaml-lint.yml
 delete mode 100644 tests/README.md

diff --git a/.gitignore b/.gitignore
index c9b2377..f56f5b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 *.retry
-tests/test.sh
+*/__pycache__
+*.pyc
diff --git a/.travis.yml b/.travis.yml
index 47ab110..d644cb5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,23 +1,33 @@
 ---
+language: python
 services: docker
 
 env:
-  - distro: centos7
-  - distro: centos6
-    playbook: test-source-install.yml
-  - distro: ubuntu1604
-  - distro: ubuntu1404
-    playbook: test-source-install.yml
-  - distro: debian8
-    playbook: test-source-install.yml
+  global:
+    - ROLE_NAME: certbot
+  matrix:
+    - MOLECULE_DISTRO: centos7
+      MOLECULE_DOCKER_COMMAND: /usr/lib/systemd/systemd
+    - MOLECULE_DISTRO: centos6
+      MOLECULE_PLAYBOOK: playbook-source-install.yml
+    - MOLECULE_DISTRO: ubuntu1604
+    - MOLECULE_DISTRO: ubuntu1404
+      MOLECULE_PLAYBOOK: playbook-source-install.yml
+    - MOLECULE_DISTRO: debian9
+
+install:
+  # Install test dependencies.
+  - pip install molecule docker
+
+before_script:
+  # Use actual Ansible Galaxy role name for the project directory.
+  - cd ../
+  - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
+  - cd geerlingguy.$ROLE_NAME
 
 script:
-  # Download test shim.
-  - wget -O ${PWD}/tests/test.sh https://gist.githubusercontent.com/geerlingguy/73ef1e5ee45d8694570f334be385e181/raw/
-  - chmod +x ${PWD}/tests/test.sh
-
   # Run tests.
-  - ${PWD}/tests/test.sh
+  - molecule test
 
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
new file mode 100644
index 0000000..0339702
--- /dev/null
+++ b/molecule/default/molecule.yml
@@ -0,0 +1,27 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+  options:
+    config-file: molecule/default/yaml-lint.yml
+platforms:
+  - name: instance
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible
+    command: ${MOLECULE_DOCKER_COMMAND:-"sleep infinity"}
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  lint:
+    name: ansible-lint
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
+scenario:
+  name: default
+verifier:
+  name: testinfra
+  lint:
+    name: flake8
diff --git a/tests/test-source-install.yml b/molecule/default/playbook-source-install.yml
similarity index 80%
rename from tests/test-source-install.yml
rename to molecule/default/playbook-source-install.yml
index d2a3d73..65a374d 100644
--- a/tests/test-source-install.yml
+++ b/molecule/default/playbook-source-install.yml
@@ -1,8 +1,10 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
+  become: true
 
   vars:
-    certbot_install_from_source: yes
+    certbot_install_from_source: true
 
   pre_tasks:
     - name: Update apt cache.
@@ -20,4 +22,4 @@
 
   roles:
     - geerlingguy.git
-    - role_under_test
+    - geerlingguy.certbot
\ No newline at end of file
diff --git a/tests/test-standalone-nginx-aws.yml b/molecule/default/playbook-standalone-nginx-aws.yml
similarity index 100%
rename from tests/test-standalone-nginx-aws.yml
rename to molecule/default/playbook-standalone-nginx-aws.yml
diff --git a/tests/test.yml b/molecule/default/playbook.yml
similarity index 87%
rename from tests/test.yml
rename to molecule/default/playbook.yml
index a242a3e..38ff20a 100644
--- a/tests/test.yml
+++ b/molecule/default/playbook.yml
@@ -1,5 +1,7 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
+  become: true
 
   pre_tasks:
     - name: Update apt cache.
@@ -19,4 +21,4 @@
       when: ansible_os_family == 'Debian'
 
   roles:
-    - role_under_test
+    - geerlingguy.certbot
\ No newline at end of file
diff --git a/tests/requirements.yml b/molecule/default/requirements.yml
similarity index 100%
rename from tests/requirements.yml
rename to molecule/default/requirements.yml
diff --git a/molecule/default/tests/test_default.py b/molecule/default/tests/test_default.py
new file mode 100644
index 0000000..eedd64a
--- /dev/null
+++ b/molecule/default/tests/test_default.py
@@ -0,0 +1,14 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_hosts_file(host):
+    f = host.file('/etc/hosts')
+
+    assert f.exists
+    assert f.user == 'root'
+    assert f.group == 'root'
diff --git a/molecule/default/yaml-lint.yml b/molecule/default/yaml-lint.yml
new file mode 100644
index 0000000..a3dbc38
--- /dev/null
+++ b/molecule/default/yaml-lint.yml
@@ -0,0 +1,6 @@
+---
+extends: default
+rules:
+  line-length:
+    max: 120
+    level: warning
diff --git a/tests/README.md b/tests/README.md
deleted file mode 100644
index 6fb2117..0000000
--- a/tests/README.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Ansible Role tests
-
-To run the test playbook(s) in this directory:
-
-  1. Install and start Docker.
-  1. Download the test shim (see .travis.yml file for the URL) into `tests/test.sh`:
-    - `wget -O tests/test.sh https://gist.githubusercontent.com/geerlingguy/73ef1e5ee45d8694570f334be385e181/raw/`
-  1. Make the test shim executable: `chmod +x tests/test.sh`.
-  1. Run (from the role root directory) `distro=[distro] playbook=[playbook] ./tests/test.sh`
-
-If you don't want the container to be automatically deleted after the test playbook is run, add the following environment variables: `cleanup=false container_id=$(date +%s)`

From 5da6dd18cd2abba84d9a8ebe67851016667365b2 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Wed, 26 Sep 2018 21:32:28 -0500
Subject: [PATCH 09/17] Fix Ansible lint issues.

---
 README.md                                     |  6 ++---
 defaults/main.yml                             | 23 +++++++++-------
 molecule/default/playbook-source-install.yml  |  2 +-
 .../default/playbook-standalone-nginx-aws.yml | 27 ++++++++++---------
 molecule/default/playbook.yml                 |  2 +-
 tasks/install-from-source.yml                 |  2 +-
 vars/Ubuntu-16.04.yml                         |  1 +
 7 files changed, 34 insertions(+), 29 deletions(-)

diff --git a/README.md b/README.md
index 5491e28..95f8239 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ Currently there is one built-in method for generating new certificates using thi
 
 **For a complete example**: see the fully functional test playbook in [tests/test-standalone-nginx-aws.yml](tests/test-standalone-nginx-aws.yml).
 
-    certbot_create_if_missing: no
+    certbot_create_if_missing: false
     certbot_create_method: standalone
 
 Set `certbot_create_if_missing` to `yes` or `True` to let this role generate certs. Set the method used for generating certs with the `certbot_create_method` variable—current allowed values include: `standalone`.
@@ -64,10 +64,10 @@ These services will only be stopped the first time a new cert is generated.
 
 You can install Certbot from it's Git source repository if desired. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).
 
-    certbot_install_from_source: no
+    certbot_install_from_source: false
     certbot_repo: https://github.com/certbot/certbot.git
     certbot_version: master
-    certbot_keep_updated: yes
+    certbot_keep_updated: true
 
 Certbot Git repository options. To install from source, set `certbot_install_from_source` to `yes`. This clones the configured `certbot_repo`, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs.
 
diff --git a/defaults/main.yml b/defaults/main.yml
index 2e79029..65f9e3c 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -7,17 +7,20 @@ certbot_auto_renew_minute: 30
 certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 # Parameters used when creating new Certbot certs.
-certbot_create_if_missing: no
+certbot_create_if_missing: false
 certbot_create_method: standalone
 certbot_admin_email: email@example.com
 certbot_certs: []
-  # - email: janedoe@example.com
-  #   domains:
-  #     - example1.com
-  #     - example2.com
-  # - domains:
-  #     - example3.com
-certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
+# - email: janedoe@example.com
+#   domains:
+#     - example1.com
+#     - example2.com
+# - domains:
+#     - example3.com
+certbot_create_command: >-
+  "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos
+  --email {{ cert_item.email | default(certbot_admin_email) }}
+  -d {{ cert_item.domains | join(',') }}"
 certbot_create_standalone_stop_services:
   - nginx
   # - apache
@@ -25,10 +28,10 @@ certbot_create_standalone_stop_services:
 
 # To install from source (on older OSes or if you need a specific or newer
 # version of Certbot), set this variable to `yes` and configure other options.
-certbot_install_from_source: no
+certbot_install_from_source: false
 certbot_repo: https://github.com/certbot/certbot.git
 certbot_version: master
-certbot_keep_updated: yes
+certbot_keep_updated: true
 
 # Where to put Certbot when installing from source.
 certbot_dir: /opt/certbot
diff --git a/molecule/default/playbook-source-install.yml b/molecule/default/playbook-source-install.yml
index 65a374d..268ae13 100644
--- a/molecule/default/playbook-source-install.yml
+++ b/molecule/default/playbook-source-install.yml
@@ -22,4 +22,4 @@
 
   roles:
     - geerlingguy.git
-    - geerlingguy.certbot
\ No newline at end of file
+    - geerlingguy.certbot
diff --git a/molecule/default/playbook-standalone-nginx-aws.yml b/molecule/default/playbook-standalone-nginx-aws.yml
index a546169..481c688 100644
--- a/molecule/default/playbook-standalone-nginx-aws.yml
+++ b/molecule/default/playbook-standalone-nginx-aws.yml
@@ -9,7 +9,7 @@
 # Play 1: Provision EC2 instance and A record.
 - hosts: localhost
   connection: local
-  gather_facts: no
+  gather_facts: false
 
   tasks:
     - name: Configure EC2 Security Group.
@@ -50,9 +50,10 @@
           Name: "certbot-standalone-nginx-test"
         group: ['default', 'certbot_test_http']
         instance_type: t2.micro
-        image: ami-02e98f78 # CentOS Linux 7 x86_64 HVM EBS
+        # CentOS Linux 7 x86_64 HVM EBS
+        image: ami-02e98f78
         region: "us-east-1"
-        wait: yes
+        wait: true
         wait_timeout: 500
         exact_count: 1
         count_tag:
@@ -68,25 +69,25 @@
         type: A
         ttl: 300
         value: "{{ created_instance.tagged_instances.0.public_ip }}"
-        wait: yes
-        overwrite: yes
+        wait: true
+        overwrite: true
 
     - name: Add EC2 instance to inventory groups.
       add_host:
         name: "certbot-test.servercheck.in"
         groups: "aws,aws_nginx"
         ansible_ssh_user: centos
-        host_key_checking: False
+        host_key_checking: false
       when: created_instance.tagged_instances.0.id is defined
 
 # Play 2: Configure EC2 instance with Certbot and Nginx.
 - hosts: aws_nginx
-  gather_facts: yes
-  become: yes
+  gather_facts: true
+  become: true
 
   vars:
     certbot_admin_email: https@servercheck.in
-    certbot_create_if_missing: yes
+    certbot_create_if_missing: true
     certbot_create_standalone_stop_services: []
     certbot_certs:
       - domains:
@@ -107,7 +108,7 @@
 
   pre_tasks:
     - name: Update apt cache.
-      apt: update_cache=yes cache_valid_time=600
+      apt: update_cache=true cache_valid_time=600
       when: ansible_os_family == 'Debian'
       changed_when: false
 
@@ -135,12 +136,12 @@
         url: https://certbot-test.servercheck.in/
         status_code: 200
       delegate_to: localhost
-      become: no
+      become: false
 
 # Play 3: Tear down EC2 instance and A record.
 - hosts: localhost
   connection: local
-  gather_facts: no
+  gather_facts: false
 
   tasks:
     - name: Destroy EC2 instance.
@@ -149,7 +150,7 @@
         instance_ids: ["{{ created_instance.tagged_instances.0.id }}"]
         region: "us-east-1"
         state: absent
-        wait: yes
+        wait: true
         wait_timeout: 500
 
     - name: Delete Security Group.
diff --git a/molecule/default/playbook.yml b/molecule/default/playbook.yml
index 38ff20a..6552819 100644
--- a/molecule/default/playbook.yml
+++ b/molecule/default/playbook.yml
@@ -21,4 +21,4 @@
       when: ansible_os_family == 'Debian'
 
   roles:
-    - geerlingguy.certbot
\ No newline at end of file
+    - geerlingguy.certbot
diff --git a/tasks/install-from-source.yml b/tasks/install-from-source.yml
index 7d97f9b..daee685 100644
--- a/tasks/install-from-source.yml
+++ b/tasks/install-from-source.yml
@@ -5,7 +5,7 @@
     dest: "{{ certbot_dir }}"
     version: "{{ certbot_version }}"
     update: "{{ certbot_keep_updated }}"
-    force: yes
+    force: true
 
 - name: Set Certbot script variable.
   set_fact:
diff --git a/vars/Ubuntu-16.04.yml b/vars/Ubuntu-16.04.yml
index 90e9138..83cf124 100644
--- a/vars/Ubuntu-16.04.yml
+++ b/vars/Ubuntu-16.04.yml
@@ -1 +1,2 @@
+---
 certbot_package: letsencrypt

From 0611410c3b19d7c40627792df2350302e1f0d312 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Wed, 26 Sep 2018 21:41:04 -0500
Subject: [PATCH 10/17] Fix Ansible lint issues.

---
 defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 65f9e3c..0e42534 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,7 +1,7 @@
 ---
 # Certbot auto-renew cron job configuration (for certificate renewals).
 certbot_auto_renew: true
-certbot_auto_renew_user: "{{ ansible_user }}"
+certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
 certbot_auto_renew_hour: 3
 certbot_auto_renew_minute: 30
 certbot_auto_renew_options: "--quiet --no-self-upgrade"

From 53b02421c037a3c3417e2e65250ef84109adb711 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Wed, 26 Sep 2018 21:53:44 -0500
Subject: [PATCH 11/17] Fix Ansible lint issues.

---
 README.md                                    | 2 +-
 molecule/default/playbook-source-install.yml | 1 +
 molecule/default/playbook.yml                | 3 +++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 95f8239..fe86a53 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@ Generally, installing from source (see section `Source Installation from Git`) l
 The variable `certbot_install_from_source` controls whether to install Certbot from Git or package management. The latter is the default, so the variable defaults to `no`.
 
     certbot_auto_renew: true
-    certbot_auto_renew_user: "{{ ansible_user }}"
+    certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
     certbot_auto_renew_hour: 3
     certbot_auto_renew_minute: 30
     certbot_auto_renew_options: "--quiet --no-self-upgrade"
diff --git a/molecule/default/playbook-source-install.yml b/molecule/default/playbook-source-install.yml
index 268ae13..77ced51 100644
--- a/molecule/default/playbook-source-install.yml
+++ b/molecule/default/playbook-source-install.yml
@@ -5,6 +5,7 @@
 
   vars:
     certbot_install_from_source: true
+    certbot_auto_renew_user: root
 
   pre_tasks:
     - name: Update apt cache.
diff --git a/molecule/default/playbook.yml b/molecule/default/playbook.yml
index 6552819..9d6e5e7 100644
--- a/molecule/default/playbook.yml
+++ b/molecule/default/playbook.yml
@@ -3,6 +3,9 @@
   hosts: all
   become: true
 
+  vars:
+    certbot_auto_renew_user: root
+
   pre_tasks:
     - name: Update apt cache.
       apt: update_cache=yes cache_valid_time=600

From a2348fdd64caf94e04846c7a07c0b8247312742f Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Thu, 27 Sep 2018 22:10:58 -0500
Subject: [PATCH 12/17] Add note on Wildcard Certificates and Let's Encrypt.
 [ci skip]

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index fe86a53..1e97da5 100644
--- a/README.md
+++ b/README.md
@@ -75,6 +75,10 @@ Certbot Git repository options. To install from source, set `certbot_install_fro
 
 The directory inside which Certbot will be cloned.
 
+### Wildcard Certificates
+
+Let's Encrypt supports [generating wildcard certificates](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579), but the process for generating and using them is slightly more involved. See comments in [this pull request](https://github.com/geerlingguy/ansible-role-certbot/pull/60#issuecomment-423919284) for an example of how to use this role to maintain wildcard certs.
+
 ## Dependencies
 
 None.

From 974fc81c9ca8a9ef000a917c194e9382534acb91 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Fri, 28 Sep 2018 20:05:09 -0500
Subject: [PATCH 13/17] Update README wildcard docs. [ci skip]

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 1e97da5..597a54a 100644
--- a/README.md
+++ b/README.md
@@ -79,6 +79,8 @@ The directory inside which Certbot will be cloned.
 
 Let's Encrypt supports [generating wildcard certificates](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579), but the process for generating and using them is slightly more involved. See comments in [this pull request](https://github.com/geerlingguy/ansible-role-certbot/pull/60#issuecomment-423919284) for an example of how to use this role to maintain wildcard certs.
 
+Michael Porter also has a walkthrough of [Creating A Let’s Encrypt Wildcard Cert With Ansible](https://www.michaelpporter.com/2018/09/creating-a-wildcard-cert-with-ansible/), specifically with Cloudflare.
+
 ## Dependencies
 
 None.

From 260a85222e2a824e452bda78a0053993f0872b55 Mon Sep 17 00:00:00 2001
From: Mario Biberhofer <m.biberhofer@igniti.de>
Date: Tue, 2 Oct 2018 10:20:22 +0200
Subject: [PATCH 14/17] Fixed syntax issue in main/defaults.yml

v3.0.0 has introduced usage of the folded block scalar syntax
(see https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html)
for the certbot_create_command variable. The usage of quotes in this
case is wrong, resulting in a command not found error.
---
 defaults/main.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 0e42534..3186d8e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -18,9 +18,10 @@ certbot_certs: []
 # - domains:
 #     - example3.com
 certbot_create_command: >-
-  "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos
+  {{ certbot_script }} certonly --standalone --noninteractive --agree-tos
   --email {{ cert_item.email | default(certbot_admin_email) }}
-  -d {{ cert_item.domains | join(',') }}"
+  -d {{ cert_item.domains | join(',') }}
+
 certbot_create_standalone_stop_services:
   - nginx
   # - apache

From 6b519ffc4dc1f9f2c6168d54bb141b01ac2c206c Mon Sep 17 00:00:00 2001
From: Adrian Moisey <adrian@changeover.za.net>
Date: Tue, 2 Oct 2018 16:29:59 +0200
Subject: [PATCH 15/17] Fix path for example

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 597a54a..599ebb0 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ By default, this role configures a cron job to run under the provided user accou
 
 Currently there is one built-in method for generating new certificates using this role: `standalone`. Other methods (e.g. using nginx or apache and a webroot) may be added in the future.
 
-**For a complete example**: see the fully functional test playbook in [tests/test-standalone-nginx-aws.yml](tests/test-standalone-nginx-aws.yml).
+**For a complete example**: see the fully functional test playbook in [molecule/default/playbook-standalone-nginx-aws.yml](molecule/default/playbook-standalone-nginx-aws.yml).
 
     certbot_create_if_missing: false
     certbot_create_method: standalone

From be44ac2dcd1954b8886725ccac36efbd4f81298a Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Tue, 23 Oct 2018 10:14:46 -0500
Subject: [PATCH 16/17] Update tests for optimum efficiency.

---
 .travis.yml                   | 2 +-
 molecule/default/molecule.yml | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index d644cb5..6e475ce 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,9 +7,9 @@ env:
     - ROLE_NAME: certbot
   matrix:
     - MOLECULE_DISTRO: centos7
-      MOLECULE_DOCKER_COMMAND: /usr/lib/systemd/systemd
     - MOLECULE_DISTRO: centos6
       MOLECULE_PLAYBOOK: playbook-source-install.yml
+    - MOLECULE_DISTRO: ubuntu1804
     - MOLECULE_DISTRO: ubuntu1604
     - MOLECULE_DISTRO: ubuntu1404
       MOLECULE_PLAYBOOK: playbook-source-install.yml
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
index 0339702..2ca6fea 100644
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -9,8 +9,10 @@ lint:
     config-file: molecule/default/yaml-lint.yml
 platforms:
   - name: instance
-    image: geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible
-    command: ${MOLECULE_DOCKER_COMMAND:-"sleep infinity"}
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
     privileged: true
     pre_build_image: true
 provisioner:

From 00dc2261017f17a73f2d380ab856edd99cdb4618 Mon Sep 17 00:00:00 2001
From: Jeff Geerling <geerlingguy@mac.com>
Date: Thu, 6 Dec 2018 16:15:09 -0600
Subject: [PATCH 17/17] Fixes E305 linting error: use shell only when required.

---
 tasks/create-cert-standalone.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tasks/create-cert-standalone.yml b/tasks/create-cert-standalone.yml
index 65c43bc..6f25b8a 100644
--- a/tasks/create-cert-standalone.yml
+++ b/tasks/create-cert-standalone.yml
@@ -12,7 +12,7 @@
   with_items: "{{ certbot_create_standalone_stop_services }}"
 
 - name: Generate new certificate if one doesn't exist.
-  shell: "{{ certbot_create_command }}"
+  command: "{{ certbot_create_command }}"
   when: not letsencrypt_cert.stat.exists
 
 - name: Start services after cert has been generated.