Merge 730ede0618d2ef3f54e678ea21eec97474b18606 into 101111391444ac4d1d407c392ab78ffe0f932910

.github/workflows/ci.yml

@@ -50,6 +50,16 @@ jobs:
           - distro: debian12
             playbook: converge.yml
             experimental: false
+<<<<<<< Updated upstream
+=======
+          - distro: debian10
+            playbook: converge.yml
+            experimental: false
+          # Source install started failing recently.
+          # - distro: centos7
+          #   playbook: playbook-source-install.yml
+          #   experimental: false
+>>>>>>> Stashed changes
 
           - distro: rockylinux9
             playbook: playbook-snap-install.yml

defaults/main.yml

@@ -29,6 +29,21 @@ certbot_certs: []
 #     - example2.com
 # - domains:
 #     - example3.com
+# - name: example4.com
+#   dns_rfc2136_credentials: "local-keyname"
+#   domains:
+#     - "example4.com"
+#     - "example5.com"
+
+# certbot_dns_rfc2136_credentials:
+#   - name: "local-keyname"
+#     server: "192.0.2.1" # ip address only
+#     port: 53
+#     key_name: "keyname-in-dns-config"
+#     secret: "example_rfc2136_secret"
+#     algorithm: "HMAC-SHA256"
+
+certbot_dns_rfc2136_propagation_seconds: 60
 
 certbot_create_command: >-
   {{ certbot_script }} certonly --{{ certbot_create_method  }}
@@ -39,6 +54,10 @@ certbot_create_command: >-
   {{ '--expand' if certbot_expand else '' }}
   {{ '--webroot-path ' if certbot_create_method == 'webroot'  else '' }}
   {{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
+  {{ '--dns-rfc2136-propagation-seconds ' if certbot_create_method == 'dns-rfc2136'  else '' }}
+  {{ certbot_dns_rfc2136_propagation_seconds if certbot_create_method == 'dns-rfc2136'  else '' }}
+  {{ '--dns-rfc2136-credentials ' if certbot_create_method == 'dns-rfc2136'  else '' }}
+  {{ '/etc/letsencrypt/' + cert_item.dns_rfc2136_credentials + '.ini' if certbot_create_method == 'dns-rfc2136'  else '' }}
   {{ certbot_create_extra_args }}
   --cert-name {{ cert_item_name }}
   -d {{ cert_item.domains | join(',') }}

molecule/default/converge.yml

@@ -9,7 +9,7 @@
   pre_tasks:
     - name: Update apt cache.
       apt: update_cache=yes cache_valid_time=600
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
       changed_when: false
 
     - name: Install dependencies (RedHat).
@@ -18,11 +18,11 @@
           - cronie
           - epel-release
         state: present
-      when: ansible_os_family == 'RedHat'
+      when: ansible_facts.os_family == 'RedHat'
 
     - name: Install cron (Debian).
       apt: name=cron state=present
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
   roles:
     - geerlingguy.certbot

molecule/default/playbook-snap-install.yml

@@ -10,16 +10,16 @@
   pre_tasks:
     - name: Update apt cache.
       apt: update_cache=yes cache_valid_time=600
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
       changed_when: false
 
     - name: Install cron (RedHat).
       yum: name=cronie state=present
-      when: ansible_os_family == 'RedHat'
+      when: ansible_facts.os_family == 'RedHat'
 
     - name: Install cron (Debian).
       apt: name=cron state=present
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
   roles:
     - geerlingguy.git

molecule/default/playbook-source-install.yml

@@ -10,16 +10,16 @@
   pre_tasks:
     - name: Update apt cache.
       apt: update_cache=yes cache_valid_time=600
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
       changed_when: false
 
     - name: Install cron (RedHat).
       yum: name=cronie state=present
-      when: ansible_os_family == 'RedHat'
+      when: ansible_facts.os_family == 'RedHat'
 
     - name: Install cron (Debian).
       apt: name=cron state=present
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
   roles:
     - geerlingguy.git

molecule/default/playbook-standalone-nginx-aws.yml

@@ -111,19 +111,19 @@
   pre_tasks:
     - name: Update apt cache.
       apt: update_cache=true cache_valid_time=600
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
       changed_when: false
 
     - name: Install dependencies (RedHat).
       yum: name={{ item }} state=present
-      when: ansible_os_family == 'RedHat'
+      when: ansible_facts.os_family == 'RedHat'
       with_items:
         - cronie
         - epel-release
 
     - name: Install cron (Debian).
       apt: name=cron state=present
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'
 
   roles:
     - geerlingguy.certbot

tasks/create-cert-dns-rfc2136.yml

@@ -0,0 +1,37 @@
+---
+- name: Determine certificate name
+  set_fact:
+    cert_item_name: "{{ cert_item.name | default(cert_item.domains | first | replace('*.', '')) }}"
+
+- name: Check if certificate already exists.
+  stat:
+    path: /etc/letsencrypt/live/{{ cert_item_name }}/cert.pem
+  register: letsencrypt_cert
+
+- name: Create dns_rfc2136_credentials files
+  template:
+    src: rfc2136_credentials.j2
+    dest: "/etc/letsencrypt/{{ item.name }}.ini"
+    mode: 0600
+  with_items: "{{ certbot_dns_rfc2136_credentials }}"
+
+- name: Check if domains have changed
+  block:
+    - name: Register certificate domains
+      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
+      changed_when: false
+      register: letsencrypt_cert_domains_dirty
+
+    - name: Cleanup domain list
+      set_fact:
+        letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
+
+    - name: Determine if domains have changed
+      set_fact:
+        letsencrypt_cert_domains_changed: "{{ letsencrypt_cert_domains != (cert_item.domains | map('trim') | select('!=', '') | list | sort) }}"
+
+  when: letsencrypt_cert.stat.exists
+
+- name: Generate new certificate if one doesn't exist.
+  command: "{{ certbot_create_command }}"
+  when: not letsencrypt_cert.stat.exists

tasks/include-vars.yml

@@ -2,7 +2,7 @@
 - name: Load a variable file based on the OS type, or a default if not found.
   include_vars: "{{ item }}"
   with_first_found:
-    - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml"
+    - "{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_version }}.yml"
-    - "{{ ansible_distribution }}.yml"
+    - "{{ ansible_facts.distribution }}.yml"
-    - "{{ ansible_os_family }}.yml"
+    - "{{ ansible_facts.os_family }}.yml"
     - "default.yml"

tasks/install-with-package.yml

@@ -1,9 +1,10 @@
 ---
 - name: Install Certbot.
   package:
-    name: "{{ certbot_package }}"
+    name: "{{ item }}"
     state: present
+  with_items: "{{ certbot_package }}"
 
 - name: Set Certbot script variable.
   set_fact:
-    certbot_script: "{{ certbot_package }}"
+    certbot_script: "{{ certbot_package[0] }}"

tasks/install-with-snap.yml

@@ -16,7 +16,7 @@
     src: /var/lib/snapd/snap
     dest: /snap
     state: link
-  when: ansible_os_family != "Debian"
+  when: ansible_facts.os_family != "Debian"
 
 - name: Update snap after install.
   shell: snap install core; snap refresh core

tasks/main.yml

@@ -2,7 +2,7 @@
 - import_tasks: include-vars.yml
 
 - import_tasks: setup-RedHat.yml
-  when: ansible_os_family == 'RedHat'
+  when: ansible_facts.os_family == 'RedHat'
 
 - import_tasks: install-with-package.yml
   when: certbot_install_method == 'package'
@@ -29,5 +29,13 @@
   loop_control:
     loop_var: cert_item
 
+- include_tasks: create-cert-dns-rfc2136.yml
+  with_items: "{{ certbot_certs }}"
+  when:
+    - certbot_create_if_missing
+    - certbot_create_method == 'dns-rfc2136'
+  loop_control:
+    loop_var: cert_item
+
 - import_tasks: renew-cron.yml
   when: certbot_auto_renew

templates/rfc2136_credentials.j2

@@ -0,0 +1,5 @@
+dns_rfc2136_server = "{{ item.server }}"
+dns_rfc2136_port = "{{ item.port }}"
+dns_rfc2136_name = "{{ item.key_name }}"
+dns_rfc2136_secret = "{{ item.secret }}"
+dns_rfc2136_algorithm = "{{ item.algorithm }}"

templates/start_services.j2

@@ -3,11 +3,11 @@
 
 {% for item in certbot_create_standalone_stop_services %}
 echo "starting service {{ item }}"
-{% if ansible_service_mgr == 'systemd' %}
+{% if ansible_facts.service_mgr == 'systemd' %}
 systemctl start {{ item }}
-{% elif ansible_service_mgr == 'upstart' %}
+{% elif ansible_facts.service_mgr == 'upstart' %}
 initctl start {{ item }}
-{% elif ansible_service_mgr == 'openrc' %}
+{% elif ansible_facts.service_mgr == 'openrc' %}
 rc-service {{ item }} start
 {% else %}
 service {{ item }} start

templates/stop_services.j2

@@ -3,11 +3,11 @@
 
 {% for item in certbot_create_standalone_stop_services %}
 echo "stopping service {{ item }}"
-{% if ansible_service_mgr == 'systemd' %}
+{% if ansible_facts.service_mgr == 'systemd' %}
 systemctl stop {{ item }}
-{% elif ansible_service_mgr == 'upstart' %}
+{% elif ansible_facts.service_mgr == 'upstart' %}
 initctl stop {{ item }}
-{% elif ansible_service_mgr == 'openrc' %}
+{% elif ansible_facts.service_mgr == 'openrc' %}
 rc-service {{ item }} stop
 {% else %}
 service {{ item }} stop

vars/default.yml

@@ -1,2 +1,4 @@
 ---
-certbot_package: certbot
+certbot_package:
+  - certbot
+  - python3-certbot-dns-rfc2136