PR #19 follow-up: Docs fixes and reordering defaults.

Install Certbot with package

.gitignore

@@ -0,0 +1,2 @@
+*.retry
+tests/test.sh

.travis.yml

@@ -1,60 +1,23 @@
 ---
-sudo: required
+services: docker
 
 env:
-  - repository: geerlingguy/docker-centos7-ansible
+  - distro: centos7
-    version: latest
+  - distro: centos6
-    init: /usr/lib/systemd/systemd
+    playbook: test-source-install.yml
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  - distro: ubuntu1604
-  - repository: geerlingguy/docker-centos6-ansible
+  - distro: ubuntu1404
-    version: latest
+    playbook: test-source-install.yml
-    init: /sbin/init
+  - distro: debian8
-    run_opts: ""
+    playbook: test-source-install.yml
-  - repository: geerlingguy/docker-ubuntu1604-ansible
-    version: latest
-    init: /lib/systemd/systemd
-    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-  - repository: geerlingguy/docker-ubuntu1404-ansible
-    version: latest
-    init: /sbin/init
-    run_opts: ""
-  - repository: geerlingguy/docker-ubuntu1204-ansible
-    version: latest
-    init: /sbin/init
-    run_opts: ""
-
-services:
-  - docker
-
-before_install:
-  # Pull container.
-  - 'sudo docker pull ${repository}:${version}'
 
 script:
-  - container_id=$(mktemp)
+  # Download test shim.
-  # Run container in detached state.
+  - wget -O ${PWD}/tests/test.sh https://gist.githubusercontent.com/geerlingguy/73ef1e5ee45d8694570f334be385e181/raw/
-  - 'sudo docker run --detach --volume="${PWD}":/etc/ansible/roles/role_under_test:ro ${run_opts} ${repository}:${version} "${init}" > "${container_id}"'
+  - chmod +x ${PWD}/tests/test.sh
 
-  # Install dependencies.
+  # Run tests.
-  - 'sudo docker exec "$(cat ${container_id})" ansible-galaxy install -r /etc/ansible/roles/role_under_test/tests/requirements.yml'
+  - ${PWD}/tests/test.sh
-
-  # Ansible syntax check.
-  - 'sudo docker exec --tty "$(cat ${container_id})" env TERM=xterm ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml --syntax-check'
-
-  # Test role.
-  - 'sudo docker exec --tty "$(cat ${container_id})" env TERM=xterm ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml'
-
-  # Test role idempotence.
-  - idempotence=$(mktemp)
-  - sudo docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/role_under_test/tests/test.yml | tee -a ${idempotence}
-  - >
-    tail ${idempotence}
-    | grep -q 'changed=0.*failed=0'
-    && (echo 'Idempotence test: pass' && exit 0)
-    || (echo 'Idempotence test: fail' && exit 1)
-
-  # Clean up.
-  - 'sudo docker stop "$(cat ${container_id})"'
 
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/

LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Jeff Geerling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -2,19 +2,33 @@
 
 [![Build Status](https://travis-ci.org/geerlingguy/ansible-role-certbot.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-certbot)
 
-Installs Certbot (for Let's Encrypt) for RHEL/CentOS or Debian/Ubuntu.
+Installs and configures Certbot (for Let's Encrypt).
 
 ## Requirements
 
-Certbot requires Git to be installed. You can install Git using the `geerlingguy.git` role.
+If installing from source, Git is required. You can install Git using the `geerlingguy.git` role.
 
 ## Role Variables
 
+The variable `certbot_install_from_source` controls whether to install Certbot from Git or package management. The latter is the default, so the variable defaults to `no`.
+
+    certbot_auto_renew: true
+    certbot_auto_renew_user: "{{ ansible_user }}"
+    certbot_auto_renew_hour: 3
+    certbot_auto_renew_minute: 30
+
+By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
+
+### Source Installation from Git
+
+You can install Certbot from it's Git source repository if desired. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).
+
+    certbot_install_from_source: no
     certbot_repo: https://github.com/certbot/certbot.git
     certbot_version: master
     certbot_keep_updated: yes
 
-Certbot code repository options. This role clones the agent from the configured repo, then makes the `certbot-auto` script executable.
+Certbot Git repository options. To install from source, set `certbot_install_from_source` to `yes`. This clones the configured `certbot_repo`, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs.
 
     certbot_dir: /opt/certbot
 
@@ -27,10 +41,16 @@ None.
 ## Example Playbook
 
     - hosts: servers
-      roles:
-        - geerlingguy.letsencrypt
     
-After installation, you can create certificates using the `certbot-auto` script, which by default is installed inside the configured `certbot_dir`, so by default, `/opt/certbot/certbot-auto`. Here are some example commands to configure certificates with Certbot:
+      vars:
+        certbot_auto_renew_user: your_username_here
+        certbot_auto_renew_minute: 20
+        certbot_auto_renew_hour: 5
+    
+      roles:
+        - geerlingguy.certbot
+
+After installation, you can create certificates using the `certbot` (or `certbot-auto`) script, which by default is installed inside the configured `certbot_dir` (when using Git). Here are some example commands to configure certificates with Certbot:
 
     # Automatically add certs for all Apache virtualhosts (use with caution!).
     /opt/certbot/certbot-auto --apache
@@ -38,9 +58,7 @@ After installation, you can create certificates using the `certbot-auto` script,
     # Generate certs, but don't modify Apache configuration (safer).
     /opt/certbot/certbot-auto --apache certonly
 
-To set up renewals, you should run the following command periodically (e.g. once or twice per day):
+By default, this role adds a cron job that will renew all installed certificates once per day at the hour and minute of your choosing.
-
-    /opt/certbot/certbot-auto renew --quiet --no-self-upgrade
 
 You can test the auto-renewal (without actually renewing the cert) with the command:
 
@@ -54,4 +72,4 @@ MIT / BSD
 
 ## Author Information
 
-This role was created in 2016 by [Jeff Geerling](http://jeffgeerling.com/), author of [Ansible for DevOps](http://ansiblefordevops.com/).
+This role was created in 2016 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

defaults/main.yml

@@ -1,6 +1,16 @@
 ---
+# Certbot auto-renew cron job configuration (for certificate renewals).
+certbot_auto_renew: true
+certbot_auto_renew_user: "{{ ansible_user }}"
+certbot_auto_renew_hour: 3
+certbot_auto_renew_minute: 30
+
+# To install from source (on older OSes or if you need a specific or newer
+# version of Certbot), set this variable to `yes` and configure other options.
+certbot_install_from_source: no
 certbot_repo: https://github.com/certbot/certbot.git
 certbot_version: master
 certbot_keep_updated: yes
 
+# Where to put Certbot when installing from source.
 certbot_dir: /opt/certbot

handlers/main.yml

@@ -1,2 +0,0 @@
----
-# TODO

meta/main.yml

@@ -3,15 +3,18 @@ dependencies: []
 
 galaxy_info:
   author: geerlingguy
-  description: "Certbot (for Let's Encrypt) for RHEL/CentOS and Debian/Ubuntu."
+  description: "Installs and configures Certbot (for Let's Encrypt)."
   company: "Midwestern Mac, LLC"
   license: "license (BSD, MIT)"
-  min_ansible_version: 1.8
+  min_ansible_version: 2.0
   platforms:
     - name: EL
       versions:
         - 6
         - 7
+    - name: Fedora
+      versions:
+        - all
     - name: Ubuntu
       versions:
         - all
@@ -22,3 +25,9 @@ galaxy_info:
     - networking
     - system
     - web
+    - certbot
+    - letsencrypt
+    - encryption
+    - certificates
+    - ssl
+    - https

tasks/include-vars.yml

@@ -0,0 +1,8 @@
+---
+- name: Load a variable file based on the OS type, or a default if not found.
+  include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml"
+    - "{{ ansible_distribution }}.yml"
+    - "{{ ansible_os_family }}.yml"
+    - "default.yml"

tasks/install-from-source.yml

@@ -0,0 +1,17 @@
+---
+- name: Clone Certbot into configured directory.
+  git:
+    repo: "{{ certbot_repo }}"
+    dest: "{{ certbot_dir }}"
+    version: "{{ certbot_version }}"
+    update: "{{ certbot_keep_updated }}"
+    force: yes
+
+- name: Set Certbot script variable.
+  set_fact:
+    certbot_script: "{{ certbot_dir }}/certbot-auto"
+
+- name: Ensure certbot-auto is executable.
+  file:
+    path: "{{ certbot_script }}"
+    mode: 0755

tasks/install-with-package.yml

@@ -0,0 +1,7 @@
+---
+- name: Install Certbot.
+  package: "name={{ certbot_package }} state=present"
+
+- name: Set Certbot script variable.
+  set_fact:
+    certbot_script: "{{ certbot_package }}"

tasks/main.yml

@@ -1,12 +1,11 @@
 ---
-- name: Clone Certbot into configured directory.
+- include: include-vars.yml
-  git:
-    repo: "{{ certbot_repo }}"
-    dest: "{{ certbot_dir }}"
-    version: "{{ certbot_version }}"
-    update: "{{ certbot_keep_updated }}"
 
-- name: Ensure certbot-auto is executable.
+- include: install-with-package.yml
-  file:
+  when: not certbot_install_from_source
-    path: "{{ certbot_dir }}/certbot-auto"
+
-    mode: 0755
+- include: install-from-source.yml
+  when: certbot_install_from_source
+
+- include: renew-cron.yml
+  when: certbot_auto_renew

tasks/renew-cron.yml

@@ -0,0 +1,8 @@
+---
+- name: Add cron job for certbot renewal (if configured).
+  cron:
+    name: Certbot automatic renewal.
+    job: "{{ certbot_script }} renew --quiet --no-self-upgrade"
+    minute: "{{ certbot_auto_renew_minute }}"
+    hour: "{{ certbot_auto_renew_hour }}"
+    user: "{{ certbot_auto_renew_user }}"

tests/README.md

@@ -0,0 +1,11 @@
+# Ansible Role tests
+
+To run the test playbook(s) in this directory:
+
+  1. Install and start Docker.
+  1. Download the test shim (see .travis.yml file for the URL) into `tests/test.sh`:
+    - `wget -O tests/test.sh https://gist.githubusercontent.com/geerlingguy/73ef1e5ee45d8694570f334be385e181/raw/`
+  1. Make the test shim executable: `chmod +x tests/test.sh`.
+  1. Run (from the role root directory) `distro=[distro] playbook=[playbook] ./tests/test.sh`
+
+If you don't want the container to be automatically deleted after the test playbook is run, add the following environment variables: `cleanup=false container_id=$(date +%s)`

tests/test-source-install.yml

@@ -0,0 +1,23 @@
+---
+- hosts: all
+
+  vars:
+    certbot_install_from_source: yes
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_os_family == 'Debian'
+      changed_when: false
+
+    - name: Install cron (RedHat).
+      yum: name=cronie state=present
+      when: ansible_os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - geerlingguy.git
+    - role_under_test

tests/test.yml

@@ -3,9 +3,17 @@
 
   pre_tasks:
     - name: Update apt cache.
-      apt: update_cache=yes
+      apt: update_cache=yes cache_valid_time=600
-      when: ansible_distribution == 'Ubuntu'
+      when: ansible_os_family == 'Debian'
+      changed_when: false
+
+    - name: Install cron (RedHat).
+      yum: name=cronie state=present
+      when: ansible_os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_os_family == 'Debian'
 
   roles:
-    - geerlingguy.git
     - role_under_test

vars/Ubuntu-16.04.yml

@@ -0,0 +1 @@
+certbot_package: letsencrypt

vars/default.yml

@@ -0,0 +1,2 @@
+---
+certbot_package: certbot