Merge pull request #146 from scottsb/patch-1

Ensure snapd is started immediately

.github/stale.yml

@@ -12,7 +12,6 @@ onlyLabels: []
 
 # Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
 exemptLabels:
-  - bug
   - pinned
   - security
   - planned

.github/workflows/ci.yml

@@ -53,10 +53,9 @@ jobs:
           - distro: debian10
             playbook: converge.yml
             experimental: false
-          # Source install started failing recently.
-          # - distro: centos7
-          #   playbook: playbook-source-install.yml
-          #   experimental: false
+          - distro: centos7
+            playbook: playbook-source-install.yml
+            experimental: false
 
           - distro: centos7
             playbook: playbook-snap-install.yml
@@ -74,7 +73,7 @@ jobs:
           python-version: '3.x'
 
       - name: Install test dependencies.
-        run: pip3 install ansible molecule molecule-plugins[docker] docker
+        run: pip3 install ansible molecule[docker] docker
 
       - name: Run Molecule tests.
         run: molecule test

.github/workflows/release.yml

@@ -32,9 +32,7 @@ jobs:
           python-version: '3.x'
 
       - name: Install Ansible.
-        run: pip3 install ansible-core
+        run: pip3 install ansible-base
 
       - name: Trigger a new import on Galaxy.
-        run: >-
-          ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }}
-          $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)
+        run: ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }} $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)

.yamllint

@@ -3,11 +3,8 @@ extends: default
 
 rules:
   line-length:
-    max: 180
+    max: 120
     level: warning
-  indentation:
-    spaces: 2
-    indent-sequences: consistent
 
 ignore: |
   .github/stale.yml

README.md

@@ -20,31 +20,20 @@ Controls how Certbot is installed. Available options are 'package', 'snap', and
     certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
     certbot_auto_renew_hour: "3"
     certbot_auto_renew_minute: "30"
-    certbot_auto_renew_options: "--quiet"
+    certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
 
 ### Automatic Certificate Generation
 
-Currently the `standalone` and `webroot` method are supported for generating new certificates using this role.
+Currently there is one built-in method for generating new certificates using this role: `standalone`. Other methods (e.g. using nginx or apache and a webroot) may be added in the future.
 
 **For a complete example**: see the fully functional test playbook in [molecule/default/playbook-standalone-nginx-aws.yml](molecule/default/playbook-standalone-nginx-aws.yml).
 
     certbot_create_if_missing: false
-
-Set `certbot_create_if_missing` to `yes` or `True` to let this role generate certs. 
-
     certbot_create_method: standalone
 
-Set the method used for generating certs with the `certbot_create_method` variable — current allowed values are: `standalone` or `webroot`.
-
-    certbot_testmode: false
-
-Enable test mode to only run a test request without actually creating certificates.
-
-    certbot_hsts: false
-
-Enable (HTTP Strict Transport Security) for the certificate generation.
+Set `certbot_create_if_missing` to `yes` or `True` to let this role generate certs. Set the method used for generating certs with the `certbot_create_method` variable—current allowed values include: `standalone`.
 
     certbot_admin_email: email@example.com
 
@@ -52,14 +41,13 @@ The email address used to agree to Let's Encrypt's TOS and subscribe to cert-rel
 
     certbot_certs: []
       # - email: janedoe@example.com
-      #   webroot: "/var/www/html"
       #   domains:
       #     - example1.com
       #     - example2.com
       # - domains:
       #     - example3.com
 
-A list of domains (and other data) for which certs should be generated. You can add an `email` key to any list item to override the `certbot_admin_email`. When using the `webroot` creation method, a `webroot` item has to be provided, specifying which directory to use for the authentication. Make sure your webserver correctly delivers contents from this directory.
+A list of domains (and other data) for which certs should be generated. You can add an `email` key to any list item to override the `certbot_admin_email`.
 
     certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
 
@@ -82,10 +70,6 @@ Setting `certbot_install_method: snap` configures this role to install Certbot v
 
 This install method is currently experimental and may or may not work across all Linux distributions.
 
-#### Webroot Certificate Generation
-
-When using the `webroot` creation method, a `webroot` item has to be provided for every `certbot_certs` item, specifying which directory to use for the authentication. Also, make sure your webserver correctly delivers contents from this directory.
-
 ### Source Installation from Git
 
 You can install Certbot from it's Git source repository if desired with `certbot_install_method: source`. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).

defaults/main.yml

@@ -4,44 +4,23 @@ certbot_auto_renew: true
 certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
 certbot_auto_renew_hour: "3"
 certbot_auto_renew_minute: "30"
-certbot_auto_renew_options: "--quiet"
-
-certbot_testmode: false
-certbot_hsts: false
-
+certbot_auto_renew_options: "--quiet --no-self-upgrade"
 
 # Parameters used when creating new Certbot certs.
 certbot_create_if_missing: false
 certbot_create_method: standalone
 certbot_admin_email: email@example.com
-
-# Default webroot, overwritten by individual per-cert webroot directories
-certbot_webroot: /var/www/letsencrypt
-
 certbot_certs: []
 # - email: janedoe@example.com
-#   webroot: "/var/www/html/"
 #   domains:
 #     - example1.com
 #     - example2.com
 # - domains:
 #     - example3.com
-
 certbot_create_command: >-
-  {{ certbot_script }} certonly --{{ certbot_create_method  }}
-  {{ '--hsts' if certbot_hsts else '' }}
-  {{ '--test-cert' if certbot_testmode else '' }}
-  --noninteractive --agree-tos
+  {{ certbot_script }} certonly --standalone --noninteractive --agree-tos
   --email {{ cert_item.email | default(certbot_admin_email) }}
-  {{ '--webroot-path ' if certbot_create_method == 'webroot'  else '' }}
-  {{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
   -d {{ cert_item.domains | join(',') }}
-  {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
-    if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
-  else '' }}
-  {{ '--post-hook /etc/letsencrypt/renewal-hooks/post/start_services'
-    if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
-  else '' }}
 
 certbot_create_standalone_stop_services:
   - nginx

molecule/default/molecule.yml

@@ -1,5 +1,4 @@
 ---
-role_name_check: 1
 dependency:
   name: galaxy
 driver:
@@ -9,8 +8,7 @@ platforms:
     image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-""}
     volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-    cgroupns_mode: host
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
     privileged: true
     pre_build_image: true
 provisioner:

tasks/create-cert-standalone.yml

@@ -4,39 +4,20 @@
     path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem
   register: letsencrypt_cert
 
-- name: Ensure pre and post hook folders exist.
-  file:
-    path: /etc/letsencrypt/renewal-hooks/{{ item }}
-    state: directory
-    mode: 0755
-    owner: root
-    group: root
-  with_items:
-    - pre
-    - post
-
-- name: Create pre hook to stop services.
-  template:
-    src: stop_services.j2
-    dest: /etc/letsencrypt/renewal-hooks/pre/stop_services
-    owner: root
-    group: root
-    mode: 0750
-  when:
-    - certbot_create_standalone_stop_services is defined
-    - certbot_create_standalone_stop_services
-
-- name: Create post hook to start services.
-  template:
-    src: start_services.j2
-    dest: /etc/letsencrypt/renewal-hooks/post/start_services
-    owner: root
-    group: root
-    mode: 0750
-  when:
-    - certbot_create_standalone_stop_services is defined
-    - certbot_create_standalone_stop_services
+- name: Stop services to allow certbot to generate a cert.
+  service:
+    name: "{{ item }}"
+    state: stopped
+  when: not letsencrypt_cert.stat.exists
+  with_items: "{{ certbot_create_standalone_stop_services }}"
 
 - name: Generate new certificate if one doesn't exist.
   command: "{{ certbot_create_command }}"
   when: not letsencrypt_cert.stat.exists
+
+- name: Start services after cert has been generated.
+  service:
+    name: "{{ item }}"
+    state: started
+  when: not letsencrypt_cert.stat.exists
+  with_items: "{{ certbot_create_standalone_stop_services }}"

tasks/create-cert-webroot.yml

@@ -1,14 +0,0 @@
----
-- name: Check if certificate already exists.
-  stat:
-    path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem
-  register: letsencrypt_cert
-
-- name: Create webroot directory if it doesn't exist yet
-  file:
-    path: "{{ cert_item.webroot | default(certbot_webroot) }}"
-    state: directory
-
-- name: Generate new certificate if one doesn't exist.
-  command: "{{ certbot_create_command }}"
-  when: not letsencrypt_cert.stat.exists

tasks/install-with-snap.yml

@@ -16,7 +16,6 @@
     src: /var/lib/snapd/snap
     dest: /snap
     state: link
-  when: ansible_os_family != "Debian"
 
 - name: Update snap after install.
   shell: snap install core; snap refresh core
@@ -34,7 +33,6 @@
     src: /snap/bin/certbot
     dest: /usr/bin/certbot
     state: link
-  ignore_errors: "{{ ansible_check_mode }}"
 
 - name: Set Certbot script variable.
   set_fact:

tasks/main.yml

@@ -21,13 +21,5 @@
   loop_control:
     loop_var: cert_item
 
-- include_tasks: create-cert-webroot.yml
-  with_items: "{{ certbot_certs }}"
-  when:
-    - certbot_create_if_missing
-    - certbot_create_method == 'webroot'
-  loop_control:
-    loop_var: cert_item
-
 - import_tasks: renew-cron.yml
   when: certbot_auto_renew

tasks/setup-RedHat.yml

@@ -7,24 +7,14 @@
       name: dnf-plugins-core
       state: present
 
-  - block:
-
-    - name: Enable DNF module for CentOS 8.3+.
-      shell: |
-        dnf config-manager --set-enabled powertools
-      register: dnf_module_enable
-      changed_when: false
-
-      when: ansible_facts['distribution_version'] is version('8.3', '>=')
-
-    - name: Enable DNF module for CentOS 8.0–8.2.
-      shell: |
-        dnf config-manager --set-enabled PowerTools
-      register: dnf_module_enable
-      changed_when: false
-
-    when: ansible_facts['distribution_version'] is version('8.2', '<=')
+  - name: Enable DNF module for CentOS 8+.
+    shell: |
+      dnf config-manager --set-enabled powertools
+    args:
+      warn: false
+    register: dnf_module_enable
+    changed_when: false
 
   when:
-  - ansible_distribution == 'CentOS'
-  - ansible_distribution_major_version | int >= 8
+    - ansible_distribution == 'CentOS'
+    - ansible_distribution_major_version | int >= 8

templates/start_services.j2

@@ -1,15 +0,0 @@
-#!/bin/bash
-# {{ ansible_managed }}
-
-{% for item in certbot_create_standalone_stop_services %}
-echo "starting service {{ item }}"
-{% if ansible_service_mgr == 'systemd' %}
-systemctl start {{ item }}
-{% elif ansible_service_mgr == 'upstart' %}
-initctl start {{ item }}
-{% elif ansible_service_mgr == 'openrc' %}
-rc-service {{ item }} start
-{% else %}
-service {{ item }} start
-{% endif %}
-{% endfor %}

templates/stop_services.j2

@@ -1,15 +0,0 @@
-#!/bin/bash
-# {{ ansible_managed }}
-
-{% for item in certbot_create_standalone_stop_services %}
-echo "stopping service {{ item }}"
-{% if ansible_service_mgr == 'systemd' %}
-systemctl stop {{ item }}
-{% elif ansible_service_mgr == 'upstart' %}
-initctl stop {{ item }}
-{% elif ansible_service_mgr == 'openrc' %}
-rc-service {{ item }} stop
-{% else %}
-service {{ item }} stop
-{% endif %}
-{% endfor %}