Merge 9dcabdc972 into 1011113914

- Added variables for pre, post, and deploy renewal hooks in defaults/main.yml.
- Created a new task file tasks/setup-hooks.yml to manage the hooks setup.
- Included setup-hooks.yml in tasks/main.yml to ensure hooks are created if specified.

.github/workflows/ci.yml

@@ -50,6 +50,16 @@ jobs:
           - distro: debian12
             playbook: converge.yml
             experimental: false
+<<<<<<< Updated upstream
+=======
+          - distro: debian10
+            playbook: converge.yml
+            experimental: false
+          # Source install started failing recently.
+          # - distro: centos7
+          #   playbook: playbook-source-install.yml
+          #   experimental: false
+>>>>>>> Stashed changes
 
           - distro: rockylinux9
             playbook: playbook-snap-install.yml

defaults/main.yml

@@ -9,6 +9,12 @@ certbot_auto_renew_options: "--quiet"
 certbot_testmode: false
 certbot_hsts: false
 
+certbot_renewal_hook_post: ""
+certbot_renewal_hook_pre: ""
+certbot_renewal_hook_deploy: ""
+certbot_renewal_hook_post_filename: "post.sh"
+certbot_renewal_hook_pre_filename: "pre.sh"
+certbot_renewal_hook_deploy_filename: "deploy.sh"
 
 # Parameters used when creating new Certbot certs.
 certbot_create_if_missing: false

tasks/create-cert-standalone.yml

@@ -44,7 +44,7 @@
 - name: Check if domains have changed
   block:
     - name: Register certificate domains
-      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E '(Domains|Identifiers)' | cut -d':' -f2"
+      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
       changed_when: false
       register: letsencrypt_cert_domains_dirty
 

tasks/create-cert-webroot.yml

@@ -16,7 +16,7 @@
 - name: Check if domains have changed
   block:
     - name: Register certificate domains
-      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E '(Domains|Identifiers)' | cut -d':' -f2"
+      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
       changed_when: false
       register: letsencrypt_cert_domains_dirty
 

tasks/main.yml

@@ -29,5 +29,7 @@
   loop_control:
     loop_var: cert_item
 
+- import_tasks: setup-hooks.yml
+
 - import_tasks: renew-cron.yml
   when: certbot_auto_renew

tasks/setup-RedHat.yml

@@ -9,4 +9,3 @@
   shell: |
     dnf config-manager --set-enabled crb
   changed_when: false
-  when: ansible_distribution != 'Fedora'

tasks/setup-hooks.yml

@@ -0,0 +1,30 @@
+---
+- name: Ensure renewal hook directories exist
+  file:
+    path: "/etc/letsencrypt/renewal-hooks/{{ item }}"
+    state: directory
+  with_items:
+    - post
+    - pre
+    - deploy
+
+- name: Create post-renewal hook
+  copy:
+    content: "{{ certbot_renewal_hook_post }}"
+    dest: "/etc/letsencrypt/renewal-hooks/post/{{ certbot_renewal_hook_post_filename }}"
+    mode: "0755"
+  when: certbot_renewal_hook_post != ""
+
+- name: Create pre-renewal hook
+  copy:
+    content: "{{ certbot_renewal_hook_pre }}"
+    dest: "/etc/letsencrypt/renewal-hooks/pre/{{ certbot_renewal_hook_pre_filename }}"
+    mode: "0755"
+  when: certbot_renewal_hook_pre != ""
+
+- name: Create deploy-renewal hook
+  copy:
+    content: "{{ certbot_renewal_hook_deploy }}"
+    dest: "/etc/letsencrypt/renewal-hooks/deploy/{{ certbot_renewal_hook_deploy_filename }}"
+    mode: "0755"
+  when: certbot_renewal_hook_deploy != ""