Merge pull request #208 from theS1LV3R/master

Allow for certificates to be expanded to include new domains

.github/workflows/ci.yml

@@ -19,12 +19,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the codebase.
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           path: 'geerlingguy.certbot'
 
       - name: Set up Python 3.
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 
@@ -41,35 +41,28 @@ jobs:
     strategy:
       matrix:
         include:
-          - distro: centos8
+          - distro: rockylinux9
             playbook: converge.yml
             experimental: false
-          - distro: centos7
-            playbook: converge.yml
-            experimental: false
-          - distro: ubuntu1804
+          - distro: ubuntu2004
             playbook: converge.yml
             experimental: false
           - distro: debian10
             playbook: converge.yml
             experimental: false
-          # Source install started failing recently.
-          # - distro: centos7
-          #   playbook: playbook-source-install.yml
-          #   experimental: false
 
-          - distro: centos7
+          - distro: rockylinux9
             playbook: playbook-snap-install.yml
             experimental: true
 
     steps:
       - name: Check out the codebase.
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           path: 'geerlingguy.certbot'
 
       - name: Set up Python 3.
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 

.github/workflows/release.yml

@@ -22,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the codebase.
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           path: 'geerlingguy.certbot'
 
       - name: Set up Python 3.
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 

defaults/main.yml

@@ -14,6 +14,7 @@ certbot_hsts: false
 certbot_create_if_missing: false
 certbot_create_method: standalone
 certbot_admin_email: email@example.com
+certbot_expand: false
 
 # Default webroot, overwritten by individual per-cert webroot directories
 certbot_webroot: /var/www/letsencrypt
@@ -27,12 +28,15 @@ certbot_certs: []
 # - domains:
 #     - example3.com
 
+certbot_create_extra_args: ""
+
 certbot_create_command: >-
   {{ certbot_script }} certonly --{{ certbot_create_method  }}
   {{ '--hsts' if certbot_hsts else '' }}
   {{ '--test-cert' if certbot_testmode else '' }}
   --noninteractive --agree-tos
   --email {{ cert_item.email | default(certbot_admin_email) }}
+  {{ '--expand' if certbot_expand else '' }}
   {{ '--webroot-path ' if certbot_create_method == 'webroot'  else '' }}
   {{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
   {{ certbot_create_extra_args }}

molecule/default/molecule.yml

@@ -2,11 +2,13 @@
 role_name_check: 1
 dependency:
   name: galaxy
+  options:
+    ignore-errors: true
 driver:
   name: docker
 platforms:
   - name: instance
-    image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest"
     command: ${MOLECULE_DOCKER_COMMAND:-""}
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw

tasks/create-cert-standalone.yml

@@ -1,9 +1,4 @@
 ---
-- name: Check if certificate already exists.
-  stat:
-    path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem
-  register: letsencrypt_cert
-
 - name: Ensure pre and post hook folders exist.
   file:
     path: /etc/letsencrypt/renewal-hooks/{{ item }}
@@ -39,4 +34,5 @@
 
 - name: Generate new certificate if one doesn't exist.
   command: "{{ certbot_create_command }}"
-  when: not letsencrypt_cert.stat.exists
+  register: certbot_create
+  changed_when: "'no action taken' not in certbot_create.stdout"

tasks/create-cert-webroot.yml

@@ -1,9 +1,4 @@
 ---
-- name: Check if certificate already exists.
-  stat:
-    path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem
-  register: letsencrypt_cert
-
 - name: Create webroot directory if it doesn't exist yet
   file:
     path: "{{ cert_item.webroot | default(certbot_webroot) }}"
@@ -11,4 +6,5 @@
 
 - name: Generate new certificate if one doesn't exist.
   command: "{{ certbot_create_command }}"
-  when: not letsencrypt_cert.stat.exists
+  register: certbot_create
+  changed_when: "'no action taken' not in certbot_create.stdout"

tasks/setup-RedHat.yml

@@ -1,30 +1,11 @@
 ---
 # See: https://github.com/geerlingguy/ansible-role-certbot/issues/107
-- block:
+- name: Ensure dnf-plugins are installed on Rocky/AlmaLinux.
+  yum:
+    name: dnf-plugins-core
+    state: present
 
-  - name: Ensure dnf-plugins are installed on CentOS 8+.
-    yum:
-      name: dnf-plugins-core
-      state: present
-
-  - block:
-
-    - name: Enable DNF module for CentOS 8.3+.
-      shell: |
-        dnf config-manager --set-enabled powertools
-      register: dnf_module_enable
-      changed_when: false
-
-      when: ansible_facts['distribution_version'] is version('8.3', '>=')
-
-    - name: Enable DNF module for CentOS 8.0–8.2.
-      shell: |
-        dnf config-manager --set-enabled PowerTools
-      register: dnf_module_enable
-      changed_when: false
-
-    when: ansible_facts['distribution_version'] is version('8.2', '<=')
-
-  when:
-  - ansible_distribution == 'CentOS'
-  - ansible_distribution_major_version | int >= 8
+- name: Enable DNF module for Rocky/AlmaLinux.
+  shell: |
+    dnf config-manager --set-enabled crb
+  changed_when: false