Fixes #37: Make renew command configurable.

README.md

@@ -16,6 +16,7 @@ The variable `certbot_install_from_source` controls whether to install Certbot f
     certbot_auto_renew_user: "{{ ansible_user }}"
     certbot_auto_renew_hour: 3
     certbot_auto_renew_minute: 30
+    certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
 
@@ -50,13 +51,27 @@ None.
       roles:
         - geerlingguy.certbot
 
-After installation, you can create certificates using the `certbot` (or `certbot-auto`) script, which by default is installed inside the configured `certbot_dir` (when using Git). Here are some example commands to configure certificates with Certbot:
+### Creating certificates with certbot
+
+After installation, you can create certificates using the `certbot` (or `certbot-auto`) script (use `letsencrypt` on Ubuntu 16.04, or use `/opt/certbot/certbot-auto` if installing from source/Git. Here are some example commands to configure certificates with Certbot:
 
     # Automatically add certs for all Apache virtualhosts (use with caution!).
-    /opt/certbot/certbot-auto --apache
+    certbot --apache
 
     # Generate certs, but don't modify Apache configuration (safer).
-    /opt/certbot/certbot-auto --apache certonly
+    certbot --apache certonly
+
+If you want to fully automate the process of adding a new certificate, you can do so using the command line options to register, accept the terms of service, and then generate a cert using the standalone server:
+
+  1. Make sure any services listening on port 80 (Apache, Nginx, Varnish, etc.) are stopped.
+  2. Register with something like `certbot register --agree-tos --email [your-email@example.com]`
+    - Note: You won't need to do this step in the future, when generating additional certs on the same server.
+  3. Generate a cert for a domain whose DNS points to this server: `certbot certonly --noninteractive --standalone -d example.com -d www.example.com`
+  4. Re-start whatever was listening on port 80 before.
+  5. Update your webserver's virtualhost TLS configuration to point at the new certificate (`fullchain.pem`) and private key (`privkey.pem`) Certbot just generated for the domain you passed in the `certbot` command.
+  6. Restart your webserver so it uses the new HTTPS virtualhost configuration.
+
+### Certbot certificate auto-renewal
 
 By default, this role adds a cron job that will renew all installed certificates once per day at the hour and minute of your choosing.
 

defaults/main.yml

@@ -4,6 +4,7 @@ certbot_auto_renew: true
 certbot_auto_renew_user: "{{ ansible_user }}"
 certbot_auto_renew_hour: 3
 certbot_auto_renew_minute: 30
+certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 # To install from source (on older OSes or if you need a specific or newer
 # version of Certbot), set this variable to `yes` and configure other options.

tasks/renew-cron.yml

@@ -2,7 +2,7 @@
 - name: Add cron job for certbot renewal (if configured).
   cron:
     name: Certbot automatic renewal.
-    job: "{{ certbot_script }} renew --quiet --no-self-upgrade"
+    job: "{{ certbot_script }} renew {{ certbot_auto_renew_options }}"
     minute: "{{ certbot_auto_renew_minute }}"
     hour: "{{ certbot_auto_renew_hour }}"
     user: "{{ certbot_auto_renew_user }}"