From ce4dacf63209fe26db0ea5f462219359ef4b41ff Mon Sep 17 00:00:00 2001 From: Michael Porter <599168+michaelpporter@users.noreply.github.com> Date: Sun, 23 Sep 2018 14:58:52 -0500 Subject: [PATCH 01/11] Supports check of wildcard certs Adds support to check for wildcard certs to not re-make them on subsequent runs --- tasks/create-cert-standalone.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/create-cert-standalone.yml b/tasks/create-cert-standalone.yml index b92faec..65c43bc 100644 --- a/tasks/create-cert-standalone.yml +++ b/tasks/create-cert-standalone.yml @@ -1,7 +1,7 @@ --- - name: Check if certificate already exists. stat: - path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem + path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem register: letsencrypt_cert - name: Stop services to allow certbot to generate a cert. From e14d6eb04a6e93655d44931e4ccf7dde029d03c7 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Wed, 26 Sep 2018 21:25:42 -0500 Subject: [PATCH 02/11] Switch tests to use Molecule. --- .gitignore | 3 +- .travis.yml | 36 ++++++++++++------- molecule/default/molecule.yml | 27 ++++++++++++++ .../default/playbook-source-install.yml | 8 +++-- .../default/playbook-standalone-nginx-aws.yml | 0 .../test.yml => molecule/default/playbook.yml | 6 ++-- {tests => molecule/default}/requirements.yml | 0 molecule/default/tests/test_default.py | 14 ++++++++ molecule/default/yaml-lint.yml | 6 ++++ tests/README.md | 11 ------ 10 files changed, 81 insertions(+), 30 deletions(-) create mode 100644 molecule/default/molecule.yml rename tests/test-source-install.yml => molecule/default/playbook-source-install.yml (80%) rename tests/test-standalone-nginx-aws.yml => molecule/default/playbook-standalone-nginx-aws.yml (100%) rename tests/test.yml => molecule/default/playbook.yml (87%) rename {tests => molecule/default}/requirements.yml (100%) create mode 100644 molecule/default/tests/test_default.py create mode 100644 molecule/default/yaml-lint.yml delete mode 100644 tests/README.md diff --git a/.gitignore b/.gitignore index c9b2377..f56f5b5 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ *.retry -tests/test.sh +*/__pycache__ +*.pyc diff --git a/.travis.yml b/.travis.yml index 47ab110..d644cb5 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,23 +1,33 @@ --- +language: python services: docker env: - - distro: centos7 - - distro: centos6 - playbook: test-source-install.yml - - distro: ubuntu1604 - - distro: ubuntu1404 - playbook: test-source-install.yml - - distro: debian8 - playbook: test-source-install.yml + global: + - ROLE_NAME: certbot + matrix: + - MOLECULE_DISTRO: centos7 + MOLECULE_DOCKER_COMMAND: /usr/lib/systemd/systemd + - MOLECULE_DISTRO: centos6 + MOLECULE_PLAYBOOK: playbook-source-install.yml + - MOLECULE_DISTRO: ubuntu1604 + - MOLECULE_DISTRO: ubuntu1404 + MOLECULE_PLAYBOOK: playbook-source-install.yml + - MOLECULE_DISTRO: debian9 -script: - # Download test shim. - - wget -O ${PWD}/tests/test.sh https://gist.githubusercontent.com/geerlingguy/73ef1e5ee45d8694570f334be385e181/raw/ - - chmod +x ${PWD}/tests/test.sh +install: + # Install test dependencies. + - pip install molecule docker + +before_script: + # Use actual Ansible Galaxy role name for the project directory. + - cd ../ + - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME + - cd geerlingguy.$ROLE_NAME +script: # Run tests. - - ${PWD}/tests/test.sh + - molecule test notifications: webhooks: https://galaxy.ansible.com/api/v1/notifications/ diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml new file mode 100644 index 0000000..0339702 --- /dev/null +++ b/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy +driver: + name: docker +lint: + name: yamllint + options: + config-file: molecule/default/yaml-lint.yml +platforms: + - name: instance + image: geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible + command: ${MOLECULE_DOCKER_COMMAND:-"sleep infinity"} + privileged: true + pre_build_image: true +provisioner: + name: ansible + lint: + name: ansible-lint + playbooks: + converge: ${MOLECULE_PLAYBOOK:-playbook.yml} +scenario: + name: default +verifier: + name: testinfra + lint: + name: flake8 diff --git a/tests/test-source-install.yml b/molecule/default/playbook-source-install.yml similarity index 80% rename from tests/test-source-install.yml rename to molecule/default/playbook-source-install.yml index d2a3d73..65a374d 100644 --- a/tests/test-source-install.yml +++ b/molecule/default/playbook-source-install.yml @@ -1,8 +1,10 @@ --- -- hosts: all +- name: Converge + hosts: all + become: true vars: - certbot_install_from_source: yes + certbot_install_from_source: true pre_tasks: - name: Update apt cache. @@ -20,4 +22,4 @@ roles: - geerlingguy.git - - role_under_test + - geerlingguy.certbot \ No newline at end of file diff --git a/tests/test-standalone-nginx-aws.yml b/molecule/default/playbook-standalone-nginx-aws.yml similarity index 100% rename from tests/test-standalone-nginx-aws.yml rename to molecule/default/playbook-standalone-nginx-aws.yml diff --git a/tests/test.yml b/molecule/default/playbook.yml similarity index 87% rename from tests/test.yml rename to molecule/default/playbook.yml index a242a3e..38ff20a 100644 --- a/tests/test.yml +++ b/molecule/default/playbook.yml @@ -1,5 +1,7 @@ --- -- hosts: all +- name: Converge + hosts: all + become: true pre_tasks: - name: Update apt cache. @@ -19,4 +21,4 @@ when: ansible_os_family == 'Debian' roles: - - role_under_test + - geerlingguy.certbot \ No newline at end of file diff --git a/tests/requirements.yml b/molecule/default/requirements.yml similarity index 100% rename from tests/requirements.yml rename to molecule/default/requirements.yml diff --git a/molecule/default/tests/test_default.py b/molecule/default/tests/test_default.py new file mode 100644 index 0000000..eedd64a --- /dev/null +++ b/molecule/default/tests/test_default.py @@ -0,0 +1,14 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_hosts_file(host): + f = host.file('/etc/hosts') + + assert f.exists + assert f.user == 'root' + assert f.group == 'root' diff --git a/molecule/default/yaml-lint.yml b/molecule/default/yaml-lint.yml new file mode 100644 index 0000000..a3dbc38 --- /dev/null +++ b/molecule/default/yaml-lint.yml @@ -0,0 +1,6 @@ +--- +extends: default +rules: + line-length: + max: 120 + level: warning diff --git a/tests/README.md b/tests/README.md deleted file mode 100644 index 6fb2117..0000000 --- a/tests/README.md +++ /dev/null @@ -1,11 +0,0 @@ -# Ansible Role tests - -To run the test playbook(s) in this directory: - - 1. Install and start Docker. - 1. Download the test shim (see .travis.yml file for the URL) into `tests/test.sh`: - - `wget -O tests/test.sh https://gist.githubusercontent.com/geerlingguy/73ef1e5ee45d8694570f334be385e181/raw/` - 1. Make the test shim executable: `chmod +x tests/test.sh`. - 1. Run (from the role root directory) `distro=[distro] playbook=[playbook] ./tests/test.sh` - -If you don't want the container to be automatically deleted after the test playbook is run, add the following environment variables: `cleanup=false container_id=$(date +%s)` From 5da6dd18cd2abba84d9a8ebe67851016667365b2 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Wed, 26 Sep 2018 21:32:28 -0500 Subject: [PATCH 03/11] Fix Ansible lint issues. --- README.md | 6 ++--- defaults/main.yml | 23 +++++++++------- molecule/default/playbook-source-install.yml | 2 +- .../default/playbook-standalone-nginx-aws.yml | 27 ++++++++++--------- molecule/default/playbook.yml | 2 +- tasks/install-from-source.yml | 2 +- vars/Ubuntu-16.04.yml | 1 + 7 files changed, 34 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index 5491e28..95f8239 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ Currently there is one built-in method for generating new certificates using thi **For a complete example**: see the fully functional test playbook in [tests/test-standalone-nginx-aws.yml](tests/test-standalone-nginx-aws.yml). - certbot_create_if_missing: no + certbot_create_if_missing: false certbot_create_method: standalone Set `certbot_create_if_missing` to `yes` or `True` to let this role generate certs. Set the method used for generating certs with the `certbot_create_method` variable—current allowed values include: `standalone`. @@ -64,10 +64,10 @@ These services will only be stopped the first time a new cert is generated. You can install Certbot from it's Git source repository if desired. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8). - certbot_install_from_source: no + certbot_install_from_source: false certbot_repo: https://github.com/certbot/certbot.git certbot_version: master - certbot_keep_updated: yes + certbot_keep_updated: true Certbot Git repository options. To install from source, set `certbot_install_from_source` to `yes`. This clones the configured `certbot_repo`, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs. diff --git a/defaults/main.yml b/defaults/main.yml index 2e79029..65f9e3c 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -7,17 +7,20 @@ certbot_auto_renew_minute: 30 certbot_auto_renew_options: "--quiet --no-self-upgrade" # Parameters used when creating new Certbot certs. -certbot_create_if_missing: no +certbot_create_if_missing: false certbot_create_method: standalone certbot_admin_email: email@example.com certbot_certs: [] - # - email: janedoe@example.com - # domains: - # - example1.com - # - example2.com - # - domains: - # - example3.com -certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}" +# - email: janedoe@example.com +# domains: +# - example1.com +# - example2.com +# - domains: +# - example3.com +certbot_create_command: >- + "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos + --email {{ cert_item.email | default(certbot_admin_email) }} + -d {{ cert_item.domains | join(',') }}" certbot_create_standalone_stop_services: - nginx # - apache @@ -25,10 +28,10 @@ certbot_create_standalone_stop_services: # To install from source (on older OSes or if you need a specific or newer # version of Certbot), set this variable to `yes` and configure other options. -certbot_install_from_source: no +certbot_install_from_source: false certbot_repo: https://github.com/certbot/certbot.git certbot_version: master -certbot_keep_updated: yes +certbot_keep_updated: true # Where to put Certbot when installing from source. certbot_dir: /opt/certbot diff --git a/molecule/default/playbook-source-install.yml b/molecule/default/playbook-source-install.yml index 65a374d..268ae13 100644 --- a/molecule/default/playbook-source-install.yml +++ b/molecule/default/playbook-source-install.yml @@ -22,4 +22,4 @@ roles: - geerlingguy.git - - geerlingguy.certbot \ No newline at end of file + - geerlingguy.certbot diff --git a/molecule/default/playbook-standalone-nginx-aws.yml b/molecule/default/playbook-standalone-nginx-aws.yml index a546169..481c688 100644 --- a/molecule/default/playbook-standalone-nginx-aws.yml +++ b/molecule/default/playbook-standalone-nginx-aws.yml @@ -9,7 +9,7 @@ # Play 1: Provision EC2 instance and A record. - hosts: localhost connection: local - gather_facts: no + gather_facts: false tasks: - name: Configure EC2 Security Group. @@ -50,9 +50,10 @@ Name: "certbot-standalone-nginx-test" group: ['default', 'certbot_test_http'] instance_type: t2.micro - image: ami-02e98f78 # CentOS Linux 7 x86_64 HVM EBS + # CentOS Linux 7 x86_64 HVM EBS + image: ami-02e98f78 region: "us-east-1" - wait: yes + wait: true wait_timeout: 500 exact_count: 1 count_tag: @@ -68,25 +69,25 @@ type: A ttl: 300 value: "{{ created_instance.tagged_instances.0.public_ip }}" - wait: yes - overwrite: yes + wait: true + overwrite: true - name: Add EC2 instance to inventory groups. add_host: name: "certbot-test.servercheck.in" groups: "aws,aws_nginx" ansible_ssh_user: centos - host_key_checking: False + host_key_checking: false when: created_instance.tagged_instances.0.id is defined # Play 2: Configure EC2 instance with Certbot and Nginx. - hosts: aws_nginx - gather_facts: yes - become: yes + gather_facts: true + become: true vars: certbot_admin_email: https@servercheck.in - certbot_create_if_missing: yes + certbot_create_if_missing: true certbot_create_standalone_stop_services: [] certbot_certs: - domains: @@ -107,7 +108,7 @@ pre_tasks: - name: Update apt cache. - apt: update_cache=yes cache_valid_time=600 + apt: update_cache=true cache_valid_time=600 when: ansible_os_family == 'Debian' changed_when: false @@ -135,12 +136,12 @@ url: https://certbot-test.servercheck.in/ status_code: 200 delegate_to: localhost - become: no + become: false # Play 3: Tear down EC2 instance and A record. - hosts: localhost connection: local - gather_facts: no + gather_facts: false tasks: - name: Destroy EC2 instance. @@ -149,7 +150,7 @@ instance_ids: ["{{ created_instance.tagged_instances.0.id }}"] region: "us-east-1" state: absent - wait: yes + wait: true wait_timeout: 500 - name: Delete Security Group. diff --git a/molecule/default/playbook.yml b/molecule/default/playbook.yml index 38ff20a..6552819 100644 --- a/molecule/default/playbook.yml +++ b/molecule/default/playbook.yml @@ -21,4 +21,4 @@ when: ansible_os_family == 'Debian' roles: - - geerlingguy.certbot \ No newline at end of file + - geerlingguy.certbot diff --git a/tasks/install-from-source.yml b/tasks/install-from-source.yml index 7d97f9b..daee685 100644 --- a/tasks/install-from-source.yml +++ b/tasks/install-from-source.yml @@ -5,7 +5,7 @@ dest: "{{ certbot_dir }}" version: "{{ certbot_version }}" update: "{{ certbot_keep_updated }}" - force: yes + force: true - name: Set Certbot script variable. set_fact: diff --git a/vars/Ubuntu-16.04.yml b/vars/Ubuntu-16.04.yml index 90e9138..83cf124 100644 --- a/vars/Ubuntu-16.04.yml +++ b/vars/Ubuntu-16.04.yml @@ -1 +1,2 @@ +--- certbot_package: letsencrypt From 0611410c3b19d7c40627792df2350302e1f0d312 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Wed, 26 Sep 2018 21:41:04 -0500 Subject: [PATCH 04/11] Fix Ansible lint issues. --- defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defaults/main.yml b/defaults/main.yml index 65f9e3c..0e42534 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,7 +1,7 @@ --- # Certbot auto-renew cron job configuration (for certificate renewals). certbot_auto_renew: true -certbot_auto_renew_user: "{{ ansible_user }}" +certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}" certbot_auto_renew_hour: 3 certbot_auto_renew_minute: 30 certbot_auto_renew_options: "--quiet --no-self-upgrade" From 53b02421c037a3c3417e2e65250ef84109adb711 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Wed, 26 Sep 2018 21:53:44 -0500 Subject: [PATCH 05/11] Fix Ansible lint issues. --- README.md | 2 +- molecule/default/playbook-source-install.yml | 1 + molecule/default/playbook.yml | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 95f8239..fe86a53 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ Generally, installing from source (see section `Source Installation from Git`) l The variable `certbot_install_from_source` controls whether to install Certbot from Git or package management. The latter is the default, so the variable defaults to `no`. certbot_auto_renew: true - certbot_auto_renew_user: "{{ ansible_user }}" + certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}" certbot_auto_renew_hour: 3 certbot_auto_renew_minute: 30 certbot_auto_renew_options: "--quiet --no-self-upgrade" diff --git a/molecule/default/playbook-source-install.yml b/molecule/default/playbook-source-install.yml index 268ae13..77ced51 100644 --- a/molecule/default/playbook-source-install.yml +++ b/molecule/default/playbook-source-install.yml @@ -5,6 +5,7 @@ vars: certbot_install_from_source: true + certbot_auto_renew_user: root pre_tasks: - name: Update apt cache. diff --git a/molecule/default/playbook.yml b/molecule/default/playbook.yml index 6552819..9d6e5e7 100644 --- a/molecule/default/playbook.yml +++ b/molecule/default/playbook.yml @@ -3,6 +3,9 @@ hosts: all become: true + vars: + certbot_auto_renew_user: root + pre_tasks: - name: Update apt cache. apt: update_cache=yes cache_valid_time=600 From a2348fdd64caf94e04846c7a07c0b8247312742f Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Thu, 27 Sep 2018 22:10:58 -0500 Subject: [PATCH 06/11] Add note on Wildcard Certificates and Let's Encrypt. [ci skip] --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index fe86a53..1e97da5 100644 --- a/README.md +++ b/README.md @@ -75,6 +75,10 @@ Certbot Git repository options. To install from source, set `certbot_install_fro The directory inside which Certbot will be cloned. +### Wildcard Certificates + +Let's Encrypt supports [generating wildcard certificates](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579), but the process for generating and using them is slightly more involved. See comments in [this pull request](https://github.com/geerlingguy/ansible-role-certbot/pull/60#issuecomment-423919284) for an example of how to use this role to maintain wildcard certs. + ## Dependencies None. From 974fc81c9ca8a9ef000a917c194e9382534acb91 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Fri, 28 Sep 2018 20:05:09 -0500 Subject: [PATCH 07/11] Update README wildcard docs. [ci skip] --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 1e97da5..597a54a 100644 --- a/README.md +++ b/README.md @@ -79,6 +79,8 @@ The directory inside which Certbot will be cloned. Let's Encrypt supports [generating wildcard certificates](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579), but the process for generating and using them is slightly more involved. See comments in [this pull request](https://github.com/geerlingguy/ansible-role-certbot/pull/60#issuecomment-423919284) for an example of how to use this role to maintain wildcard certs. +Michael Porter also has a walkthrough of [Creating A Let’s Encrypt Wildcard Cert With Ansible](https://www.michaelpporter.com/2018/09/creating-a-wildcard-cert-with-ansible/), specifically with Cloudflare. + ## Dependencies None. From 260a85222e2a824e452bda78a0053993f0872b55 Mon Sep 17 00:00:00 2001 From: Mario Biberhofer Date: Tue, 2 Oct 2018 10:20:22 +0200 Subject: [PATCH 08/11] Fixed syntax issue in main/defaults.yml v3.0.0 has introduced usage of the folded block scalar syntax (see https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html) for the certbot_create_command variable. The usage of quotes in this case is wrong, resulting in a command not found error. --- defaults/main.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 0e42534..3186d8e 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -18,9 +18,10 @@ certbot_certs: [] # - domains: # - example3.com certbot_create_command: >- - "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos + {{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} - -d {{ cert_item.domains | join(',') }}" + -d {{ cert_item.domains | join(',') }} + certbot_create_standalone_stop_services: - nginx # - apache From 6b519ffc4dc1f9f2c6168d54bb141b01ac2c206c Mon Sep 17 00:00:00 2001 From: Adrian Moisey Date: Tue, 2 Oct 2018 16:29:59 +0200 Subject: [PATCH 09/11] Fix path for example --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 597a54a..599ebb0 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ By default, this role configures a cron job to run under the provided user accou Currently there is one built-in method for generating new certificates using this role: `standalone`. Other methods (e.g. using nginx or apache and a webroot) may be added in the future. -**For a complete example**: see the fully functional test playbook in [tests/test-standalone-nginx-aws.yml](tests/test-standalone-nginx-aws.yml). +**For a complete example**: see the fully functional test playbook in [molecule/default/playbook-standalone-nginx-aws.yml](molecule/default/playbook-standalone-nginx-aws.yml). certbot_create_if_missing: false certbot_create_method: standalone From be44ac2dcd1954b8886725ccac36efbd4f81298a Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Tue, 23 Oct 2018 10:14:46 -0500 Subject: [PATCH 10/11] Update tests for optimum efficiency. --- .travis.yml | 2 +- molecule/default/molecule.yml | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.travis.yml b/.travis.yml index d644cb5..6e475ce 100644 --- a/.travis.yml +++ b/.travis.yml @@ -7,9 +7,9 @@ env: - ROLE_NAME: certbot matrix: - MOLECULE_DISTRO: centos7 - MOLECULE_DOCKER_COMMAND: /usr/lib/systemd/systemd - MOLECULE_DISTRO: centos6 MOLECULE_PLAYBOOK: playbook-source-install.yml + - MOLECULE_DISTRO: ubuntu1804 - MOLECULE_DISTRO: ubuntu1604 - MOLECULE_DISTRO: ubuntu1404 MOLECULE_PLAYBOOK: playbook-source-install.yml diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml index 0339702..2ca6fea 100644 --- a/molecule/default/molecule.yml +++ b/molecule/default/molecule.yml @@ -9,8 +9,10 @@ lint: config-file: molecule/default/yaml-lint.yml platforms: - name: instance - image: geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible - command: ${MOLECULE_DOCKER_COMMAND:-"sleep infinity"} + image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro privileged: true pre_build_image: true provisioner: From 00dc2261017f17a73f2d380ab856edd99cdb4618 Mon Sep 17 00:00:00 2001 From: Jeff Geerling Date: Thu, 6 Dec 2018 16:15:09 -0600 Subject: [PATCH 11/11] Fixes E305 linting error: use shell only when required. --- tasks/create-cert-standalone.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/create-cert-standalone.yml b/tasks/create-cert-standalone.yml index 65c43bc..6f25b8a 100644 --- a/tasks/create-cert-standalone.yml +++ b/tasks/create-cert-standalone.yml @@ -12,7 +12,7 @@ with_items: "{{ certbot_create_standalone_stop_services }}" - name: Generate new certificate if one doesn't exist. - shell: "{{ certbot_create_command }}" + command: "{{ certbot_create_command }}" when: not letsencrypt_cert.stat.exists - name: Start services after cert has been generated.