Merge pull request #146 from scottsb/patch-1

Ensure snapd is started immediately

.ansible-lint

@@ -0,0 +1,3 @@
+skip_list:
+  - 'yaml'
+  - 'role-name'

.github/workflows/ci.yml

@@ -0,0 +1,85 @@
+---
+name: CI
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: "30 2 * * 0"
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.certbot'
+
+jobs:
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+        with:
+          path: 'geerlingguy.certbot'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install test dependencies.
+        run: pip3 install yamllint
+
+      - name: Lint code.
+        run: |
+          yamllint .
+
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - distro: centos8
+            playbook: converge.yml
+            experimental: false
+          - distro: centos7
+            playbook: converge.yml
+            experimental: false
+          - distro: ubuntu1804
+            playbook: converge.yml
+            experimental: false
+          - distro: debian10
+            playbook: converge.yml
+            experimental: false
+          - distro: centos7
+            playbook: playbook-source-install.yml
+            experimental: false
+
+          - distro: centos7
+            playbook: playbook-snap-install.yml
+            experimental: true
+
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+        with:
+          path: 'geerlingguy.certbot'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install test dependencies.
+        run: pip3 install ansible molecule[docker] docker
+
+      - name: Run Molecule tests.
+        run: molecule test
+        continue-on-error: ${{ matrix.experimental }}
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+          MOLECULE_DISTRO: ${{ matrix.distro }}
+          MOLECULE_PLAYBOOK: ${{ matrix.playbook }}

.github/workflows/release.yml

@@ -0,0 +1,38 @@
+---
+# This workflow requires a GALAXY_API_KEY secret present in the GitHub
+# repository or organization.
+#
+# See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy
+# See: https://github.com/ansible/galaxy/issues/46
+
+name: Release
+'on':
+  push:
+    tags:
+      - '*'
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.certbot'
+
+jobs:
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+        with:
+          path: 'geerlingguy.certbot'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install Ansible.
+        run: pip3 install ansible-base
+
+      - name: Trigger a new import on Galaxy.
+        run: ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }} $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)

.gitignore

@@ -1,3 +1,5 @@
 *.retry
 */__pycache__
 *.pyc
+.cache
+

.travis.yml

@@ -1,32 +0,0 @@
----
-language: python
-services: docker
-
-env:
-  global:
-    - ROLE_NAME: certbot
-  matrix:
-    - MOLECULE_DISTRO: centos8
-    - MOLECULE_DISTRO: centos7
-    - MOLECULE_DISTRO: centos6
-      MOLECULE_PLAYBOOK: playbook-source-install.yml
-    - MOLECULE_DISTRO: ubuntu1804
-    - MOLECULE_DISTRO: ubuntu1604
-    - MOLECULE_DISTRO: debian10
-
-install:
-  # Install test dependencies.
-  - pip install molecule yamllint ansible-lint docker
-
-before_script:
-  # Use actual Ansible Galaxy role name for the project directory.
-  - cd ../
-  - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
-  - cd geerlingguy.$ROLE_NAME
-
-script:
-  # Run tests.
-  - molecule test
-
-notifications:
-  webhooks: https://galaxy.ansible.com/api/v1/notifications/

README.md

@@ -1,6 +1,6 @@
 # Ansible Role: Certbot (for Let's Encrypt)
 
-[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-certbot.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-certbot)
+[![CI](https://github.com/geerlingguy/ansible-role-certbot/workflows/CI/badge.svg?event=push)](https://github.com/geerlingguy/ansible-role-certbot/actions?query=workflow%3ACI)
 
 Installs and configures Certbot (for Let's Encrypt).
 
@@ -12,7 +12,9 @@ Generally, installing from source (see section `Source Installation from Git`) l
 
 ## Role Variables
 
-The variable `certbot_install_from_source` controls whether to install Certbot from Git or package management. The latter is the default, so the variable defaults to `no`.
+    certbot_install_method: package
+
+Controls how Certbot is installed. Available options are 'package', 'snap', and 'source'.
 
     certbot_auto_renew: true
     certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
@@ -60,16 +62,23 @@ Services that should be stopped while `certbot` runs it's own standalone server
 
 These services will only be stopped the first time a new cert is generated.
 
+### Snap Installation
+
+Beginning in December 2020, the Certbot maintainers decided to recommend installing Certbot from Snap rather than maintain scripts like `certbot-auto`.
+
+Setting `certbot_install_method: snap` configures this role to install Certbot via Snap.
+
+This install method is currently experimental and may or may not work across all Linux distributions.
+
 ### Source Installation from Git
 
-You can install Certbot from it's Git source repository if desired. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).
+You can install Certbot from it's Git source repository if desired with `certbot_install_method: source`. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).
 
-    certbot_install_from_source: false
     certbot_repo: https://github.com/certbot/certbot.git
     certbot_version: master
     certbot_keep_updated: true
 
-Certbot Git repository options. To install from source, set `certbot_install_from_source` to `yes`. This clones the configured `certbot_repo`, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs.
+Certbot Git repository options. If installing from source, the configured `certbot_repo` is cloned, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs.
 
     certbot_dir: /opt/certbot
 

defaults/main.yml

@@ -27,9 +27,10 @@ certbot_create_standalone_stop_services:
   # - apache
   # - varnish
 
-# To install from source (on older OSes or if you need a specific or newer
-# version of Certbot), set this variable to `yes` and configure other options.
-certbot_install_from_source: false
+# Available options: 'package', 'snap', 'source'.
+certbot_install_method: 'package'
+
+# Source install configuration.
 certbot_repo: https://github.com/certbot/certbot.git
 certbot_version: master
 certbot_keep_updated: true

meta/main.yml

@@ -2,6 +2,7 @@
 dependencies: []
 
 galaxy_info:
+  role_name: certbot
   author: geerlingguy
   description: "Installs and configures Certbot (for Let's Encrypt)."
   company: "Midwestern Mac, LLC"
@@ -10,7 +11,6 @@ galaxy_info:
   platforms:
     - name: EL
       versions:
-        - 6
         - 7
         - 8
     - name: Fedora

molecule/default/converge.yml

@@ -13,11 +13,12 @@
       changed_when: false
 
     - name: Install dependencies (RedHat).
-      yum: name={{ item }} state=present
-      when: ansible_os_family == 'RedHat'
-      with_items:
+      yum:
+        name:
           - cronie
           - epel-release
+        state: present
+      when: ansible_os_family == 'RedHat'
 
     - name: Install cron (Debian).
       apt: name=cron state=present

molecule/default/molecule.yml

@@ -3,10 +3,6 @@ dependency:
   name: galaxy
 driver:
   name: docker
-lint: |
-  set -e
-  yamllint .
-  ansible-lint
 platforms:
   - name: instance
     image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"

molecule/default/playbook-snap-install.yml

@@ -0,0 +1,26 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  vars:
+    certbot_install_method: 'snap'
+    certbot_auto_renew_user: root
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_os_family == 'Debian'
+      changed_when: false
+
+    - name: Install cron (RedHat).
+      yum: name=cronie state=present
+      when: ansible_os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - geerlingguy.git
+    - geerlingguy.certbot

molecule/default/playbook-source-install.yml

@@ -4,7 +4,7 @@
   become: true
 
   vars:
-    certbot_install_from_source: true
+    certbot_install_method: 'source'
     certbot_auto_renew_user: root
 
   pre_tasks:

tasks/install-with-snap.yml

@@ -0,0 +1,39 @@
+---
+- name: Ensure snapd is installed.
+  package:
+    name: snapd
+    state: present
+  register: snapd_install
+
+- name: Ensure snapd is enabled.
+  systemd:
+    name: snapd.socket
+    enabled: true
+    state: started
+
+- name: Enable classic snap support.
+  file:
+    src: /var/lib/snapd/snap
+    dest: /snap
+    state: link
+
+- name: Update snap after install.
+  shell: snap install core; snap refresh core
+  changed_when: true
+  failed_when: false
+  when: snapd_install is changed
+
+- name: Install certbot via snap.
+  snap:
+    name: certbot
+    classic: true
+
+- name: Symlink certbot into place.
+  file:
+    src: /snap/bin/certbot
+    dest: /usr/bin/certbot
+    state: link
+
+- name: Set Certbot script variable.
+  set_fact:
+    certbot_script: /usr/bin/certbot

tasks/main.yml

@@ -5,10 +5,13 @@
   when: ansible_os_family == 'RedHat'
 
 - import_tasks: install-with-package.yml
-  when: not certbot_install_from_source
+  when: certbot_install_method == 'package'
+
+- import_tasks: install-with-snap.yml
+  when: certbot_install_method == 'snap'
 
 - import_tasks: install-from-source.yml
-  when: certbot_install_from_source
+  when: certbot_install_method == 'source'
 
 - include_tasks: create-cert-standalone.yml
   with_items: "{{ certbot_certs }}"

tasks/setup-RedHat.yml

@@ -9,12 +9,12 @@
 
   - name: Enable DNF module for CentOS 8+.
     shell: |
-      dnf config-manager --set-enabled PowerTools
+      dnf config-manager --set-enabled powertools
     args:
       warn: false
     register: dnf_module_enable
     changed_when: false
 
   when:
-    - ansible_os_family == 'RedHat'
+    - ansible_distribution == 'CentOS'
     - ansible_distribution_major_version | int >= 8