Merge pull request #14 from geerlingguy/certbot-auto-renew

Fixes #13: Certbot auto renew cron job

.travis.yml

@@ -1,55 +1,49 @@
 ---
-sudo: required
+services: docker
 
 env:
-  - distribution: centos
+  - distro: centos7
-    version: 6
-    init: /sbin/init
-    run_opts: ""
-  - distribution: centos
-    version: 7
     init: /usr/lib/systemd/systemd
     run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-  - distribution: ubuntu
+  - distro: centos6
-    version: 14.04
     init: /sbin/init
     run_opts: ""
-  - distribution: ubuntu
+  - distro: ubuntu1604
-    version: 12.04
+    init: /lib/systemd/systemd
+    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  - distro: ubuntu1404
+    init: /sbin/init
+    run_opts: ""
+  - distro: ubuntu1204
     init: /sbin/init
     run_opts: ""
-
-services:
-  - docker
 
 before_install:
-  # Pull container
+  # Pull container.
-  - 'sudo docker pull ${distribution}:${version}'
+  - 'docker pull geerlingguy/docker-${distro}-ansible:latest'
-  # Customize container
-  - 'sudo docker build --rm=true --file=tests/Dockerfile.${distribution}-${version} --tag=${distribution}-${version}:ansible tests'
 
 script:
   - container_id=$(mktemp)
-  # Run container in detached state
+  # Run container in detached state.
-  - 'sudo docker run --detach --volume="${PWD}":/etc/ansible/roles/role_under_test:ro ${run_opts} ${distribution}-${version}:ansible "${init}" > "${container_id}"'
+  - 'docker run --detach --volume="${PWD}":/etc/ansible/roles/role_under_test:ro ${run_opts} geerlingguy/docker-${distro}-ansible:latest "${init}" > "${container_id}"'
+
+  # Install dependencies.
+  - 'docker exec "$(cat ${container_id})" ansible-galaxy install -r /etc/ansible/roles/role_under_test/tests/requirements.yml'
 
   # Ansible syntax check.
-  - 'sudo docker exec --tty "$(cat ${container_id})" env TERM=xterm ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml --syntax-check'
+  - 'docker exec --tty "$(cat ${container_id})" env TERM=xterm ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml --syntax-check'
 
   # Test role.
-  - 'sudo docker exec --tty "$(cat ${container_id})" env TERM=xterm ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml'
+  - 'docker exec --tty "$(cat ${container_id})" env TERM=xterm ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml'
 
   # Test role idempotence.
   - idempotence=$(mktemp)
-  - sudo docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml | tee -a ${idempotence}
+  - docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml | tee -a ${idempotence}
   - >
     tail ${idempotence}
     | grep -q 'changed=0.*failed=0'
     && (echo 'Idempotence test: pass' && exit 0)
     || (echo 'Idempotence test: fail' && exit 1)
 
-  # Clean up
-  - 'sudo docker stop "$(cat ${container_id})"'
-
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/

README.md

@@ -20,6 +20,13 @@ Certbot code repository options. This role clones the agent from the configured
 
 The directory inside which Certbot will be cloned.
 
+    certbot_auto_renew: true
+    certbot_auto_renew_user: "{{ ansible_user }}"
+    certbot_auto_renew_hour: 3
+    certbot_auto_renew_minute: 30
+
+By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot-auto renew` via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
+
 ## Dependencies
 
 None.
@@ -27,8 +34,14 @@ None.
 ## Example Playbook
 
     - hosts: servers
+    
+      vars:
+        certbot_auto_renew_user: your_username_here
+        certbot_auto_renew_minute: 20
+        certbot_auto_renew_hour: 5
+    
       roles:
-        - geerlingguy.letsencrypt
+        - geerlingguy.certbot
 
 After installation, you can create certificates using the `certbot-auto` script, which by default is installed inside the configured `certbot_dir`, so by default, `/opt/certbot/certbot-auto`. Here are some example commands to configure certificates with Certbot:
 
@@ -38,9 +51,7 @@ After installation, you can create certificates using the `certbot-auto` script,
     # Generate certs, but don't modify Apache configuration (safer).
     /opt/certbot/certbot-auto --apache certonly
 
-To set up renewals, you should run the following command periodically (e.g. once or twice per day):
+By default, this role adds a cron job that will renew all installed certificates once per day at the hour and minute of your choosing.
-
-    /opt/certbot/certbot-auto renew --quiet --no-self-upgrade
 
 You can test the auto-renewal (without actually renewing the cert) with the command:
 
@@ -54,4 +65,4 @@ MIT / BSD
 
 ## Author Information
 
-This role was created in 2016 by [Jeff Geerling](http://jeffgeerling.com/), author of [Ansible for DevOps](http://ansiblefordevops.com/).
+This role was created in 2016 by [Jeff Geerling](http://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

defaults/main.yml

@@ -1,6 +1,14 @@
 ---
+# Where to get Certbot.
 certbot_repo: https://github.com/certbot/certbot.git
 certbot_version: master
 certbot_keep_updated: yes
 
+# Where to put Certbot.
 certbot_dir: /opt/certbot
+
+# How to keep Certbot certs up to date.
+certbot_auto_renew: true
+certbot_auto_renew_user: "{{ ansible_user }}"
+certbot_auto_renew_hour: 3
+certbot_auto_renew_minute: 30

meta/main.yml

@@ -22,3 +22,9 @@ galaxy_info:
     - networking
     - system
     - web
+    - certbot
+    - letsencrypt
+    - encryption
+    - certificates
+    - ssl
+    - https

tasks/main.yml

@@ -10,3 +10,12 @@
   file:
     path: "{{ certbot_dir }}/certbot-auto"
     mode: 0755
+
+- name: Add cron job for 'certbot-auto renew' (if configured).
+  cron:
+    name: Certbot automatic renewal.
+    job: "{{ certbot_dir }}/certbot-auto renew --quiet --no-self-upgrade"
+    minute: "{{ certbot_auto_renew_minute }}"
+    hour: "{{ certbot_auto_renew_hour }}"
+    user: "{{ certbot_auto_renew_user }}"
+  when: certbot_auto_renew

tests/Dockerfile.centos-6

@@ -1,15 +0,0 @@
-FROM centos:6
-
-# Install Ansible
-RUN yum -y update; yum clean all;
-RUN yum -y install epel-release
-RUN yum -y install git ansible sudo
-RUN yum clean all
-
-# Disable requiretty
-RUN sed -i -e 's/^\(Defaults\s*requiretty\)/#--- \1/'  /etc/sudoers
-
-# Install Ansible inventory file
-RUN echo -e '[local]\nlocalhost ansible_connection=local' > /etc/ansible/hosts
-
-CMD ["/usr/sbin/init"]

tests/Dockerfile.centos-7

@@ -1,27 +0,0 @@
-FROM centos:7
-
-# Install systemd -- See https://hub.docker.com/_/centos/
-RUN yum -y swap -- remove fakesystemd -- install systemd systemd-libs
-RUN yum -y update; yum clean all; \
-(cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \
-rm -f /lib/systemd/system/multi-user.target.wants/*; \
-rm -f /etc/systemd/system/*.wants/*; \
-rm -f /lib/systemd/system/local-fs.target.wants/*; \
-rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
-rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
-rm -f /lib/systemd/system/basic.target.wants/*; \
-rm -f /lib/systemd/system/anaconda.target.wants/*;
-
-# Install Ansible
-RUN yum -y install epel-release
-RUN yum -y install git ansible sudo
-RUN yum clean all
-
-# Disable requiretty
-RUN sed -i -e 's/^\(Defaults\s*requiretty\)/#--- \1/'  /etc/sudoers
-
-# Install Ansible inventory file
-RUN echo -e '[local]\nlocalhost ansible_connection=local' > /etc/ansible/hosts
-
-VOLUME ["/sys/fs/cgroup"]
-CMD ["/usr/sbin/init"]

tests/Dockerfile.ubuntu-12.04

@@ -1,11 +0,0 @@
-FROM ubuntu:12.04
-RUN apt-get update
-
-# Install Ansible
-RUN apt-get install -y software-properties-common python-software-properties git
-RUN apt-add-repository -y ppa:ansible/ansible
-RUN apt-get update
-RUN apt-get install -y ansible
-
-# Install Ansible inventory file
-RUN echo "[local]\nlocalhost ansible_connection=local" > /etc/ansible/hosts

tests/Dockerfile.ubuntu-14.04

@@ -1,11 +0,0 @@
-FROM ubuntu:14.04
-RUN apt-get update
-
-# Install Ansible
-RUN apt-get install -y software-properties-common git
-RUN apt-add-repository -y ppa:ansible/ansible
-RUN apt-get update
-RUN apt-get install -y ansible
-
-# Install Ansible inventory file
-RUN echo "[local]\nlocalhost ansible_connection=local" > /etc/ansible/hosts

tests/requirements.yml

@@ -0,0 +1,2 @@
+---
+- src: geerlingguy.git

tests/test.yml

@@ -1,5 +1,20 @@
 ---
 - hosts: all
 
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_os_family == 'Debian'
+      changed_when: false
+
+    - name: Install cron (RedHat).
+      yum: name=cronie state=present
+      when: ansible_os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_os_family == 'Debian'
+
   roles:
+    - geerlingguy.git
     - role_under_test