Merge pull request #245 from nonno-cicala/master

Fix Fedora

.github/workflows/ci.yml

@@ -50,16 +50,6 @@ jobs:
           - distro: debian12
             playbook: converge.yml
             experimental: false
-<<<<<<< Updated upstream
-=======
-          - distro: debian10
-            playbook: converge.yml
-            experimental: false
-          # Source install started failing recently.
-          # - distro: centos7
-          #   playbook: playbook-source-install.yml
-          #   experimental: false
->>>>>>> Stashed changes
 
           - distro: rockylinux9
             playbook: playbook-snap-install.yml

README.md

@@ -26,12 +26,7 @@ By default, this role configures a cron job to run under the provided user accou
 
 ### Automatic Certificate Generation
 
-Current methods supported for generating new certificates using this role:
-
-  - `standalone`
-  - `webroot`
-  - `nginx`
-  - `dns-cloudflare`
+Currently the `standalone` and `webroot` method are supported for generating new certificates using this role.
 
 **For a complete example**: see the fully functional test playbook in [molecule/default/playbook-standalone-nginx-aws.yml](molecule/default/playbook-standalone-nginx-aws.yml).
 
@@ -41,7 +36,7 @@ Set `certbot_create_if_missing` to `yes` or `True` to let this role generate cer
 
     certbot_create_method: standalone
 
-Set the method used for generating certs with the `certbot_create_method` variable — current allowed values are: `standalone`, `webroot` or 'dns-cloudflare'.
+Set the method used for generating certs with the `certbot_create_method` variable — current allowed values are: `standalone` or `webroot`.
 
     certbot_testmode: false
 
@@ -91,15 +86,6 @@ This install method is currently experimental and may or may not work across all
 
 When using the `webroot` creation method, a `webroot` item has to be provided for every `certbot_certs` item, specifying which directory to use for the authentication. Also, make sure your webserver correctly delivers contents from this directory.
 
-### nginx Certificate Generation
-
-When using the `nginx` creation method, `nginx` package will be installed as a dependency of `python3-certbot-nginx`.
-
-#### dns-cloudflare Certificate Generation
-
-When using the `dns-cloudflare` creation method, set `certbot_dns_cloudflare_api_token` with your Cloudflare API token.
-The process will generate a `dns-01` challenge (*DNS01*) by creating, and subsequently removing, TXT records using the Cloudflare API. See [certbot-dns-cloudflare documentation](https://certbot-dns-cloudflare.readthedocs.io/en/stable/) for details.
-
 ### Source Installation from Git
 
 You can install Certbot from it's Git source repository if desired with `certbot_install_method: source`. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).

defaults/main.yml

@@ -40,17 +40,14 @@ certbot_create_command: >-
   {{ '--webroot-path ' if certbot_create_method == 'webroot'  else '' }}
   {{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
   {{ certbot_create_extra_args }}
-  {{ '--dns-cloudflare-credentials /etc/letsencrypt/dnscloudflare.ini'
-    if certbot_create_method == 'dns-cloudflare'
-  else '' }}
   --cert-name {{ cert_item_name }}
   -d {{ cert_item.domains | join(',') }}
   {{ '--expand' if certbot_expand else '' }}
   {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
-    if certbot_create_standalone_stop_services and certbot_create_method in ['standalone', 'nginx']
+    if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
   else '' }}
   {{ '--post-hook /etc/letsencrypt/renewal-hooks/post/start_services'
-    if certbot_create_standalone_stop_services and certbot_create_method in ['standalone', 'nginx']
+    if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
   else '' }}
   {{ "--deploy-hook '" ~ cert_item.deploy_hook ~ "'"
     if 'deploy_hook' in cert_item
@@ -61,8 +58,6 @@ certbot_create_standalone_stop_services:
   # - apache
   # - varnish
 
-certbot_dns_cloudflare_api_token: fakeone
-
 # Available options: 'package', 'snap', 'source'.
 certbot_install_method: 'package'
 

tasks/create-cert-dns-cloudflare.yml

@@ -1,15 +0,0 @@
----
-- name: Determine certificate name
-  set_fact:
-    cert_item_name: "{{ cert_item.name | default(cert_item.domains | first | replace('*.', '')) }}"
-
-- name: Check if certificate already exists.
-  stat:
-    path: /etc/letsencrypt/live/{{ cert_item_name }}/cert.pem
-  register: letsencrypt_cert
-  become: true
-
-- name: Generate new certificate if one doesn't exist.
-  command: "{{ certbot_create_command }}"
-  when: not letsencrypt_cert.stat.exists
-  become: true

tasks/create-cert-nginx.yml

@@ -1,65 +0,0 @@
----
-- name: Determine certificate name
-  set_fact:
-    cert_item_name: "{{ cert_item.name | default(cert_item.domains | first | replace('*.', '')) }}"
-
-- name: Check if certificate already exists.
-  stat:
-    path: /etc/letsencrypt/live/{{ cert_item_name }}/cert.pem
-  register: letsencrypt_cert
-  become: true
-
-- name: Ensure pre and post hook folders exist.
-  file:
-    path: /etc/letsencrypt/renewal-hooks/{{ item }}
-    state: directory
-    mode: 0755
-    owner: root
-    group: root
-  with_items:
-    - pre
-    - post
-
-- name: Create pre hook to stop services.
-  template:
-    src: stop_services.j2
-    dest: /etc/letsencrypt/renewal-hooks/pre/stop_services
-    owner: root
-    group: root
-    mode: 0750
-  when:
-    - certbot_create_standalone_stop_services is defined
-    - certbot_create_standalone_stop_services is truthy
-
-- name: Create post hook to start services.
-  template:
-    src: start_services.j2
-    dest: /etc/letsencrypt/renewal-hooks/post/start_services
-    owner: root
-    group: root
-    mode: 0750
-  when:
-    - certbot_create_standalone_stop_services is defined
-    - certbot_create_standalone_stop_services is truthy
-
-- name: Check if domains have changed
-  block:
-    - name: Register certificate domains
-      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
-      changed_when: false
-      register: letsencrypt_cert_domains_dirty
-
-    - name: Cleanup domain list
-      set_fact:
-        letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
-
-    - name: Determine if domains have changed
-      set_fact:
-        letsencrypt_cert_domains_changed: "{{ letsencrypt_cert_domains != (cert_item.domains | map('trim') | select('!=', '') | list | sort) }}"
-
-  when: letsencrypt_cert.stat.exists
-
-- name: Generate new certificate if one doesn't exist.
-  command: "{{ certbot_create_command }}"
-  when: not letsencrypt_cert.stat.exists or letsencrypt_cert_domains_changed | default(false)
-  become: true

tasks/create-cert-standalone.yml

@@ -44,7 +44,7 @@
 - name: Check if domains have changed
   block:
     - name: Register certificate domains
-      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
+      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E '(Domains|Identifiers)' | cut -d':' -f2"
       changed_when: false
       register: letsencrypt_cert_domains_dirty
 

tasks/create-cert-webroot.yml

@@ -16,7 +16,7 @@
 - name: Check if domains have changed
   block:
     - name: Register certificate domains
-      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
+      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E '(Domains|Identifiers)' | cut -d':' -f2"
       changed_when: false
       register: letsencrypt_cert_domains_dirty
 

tasks/install-with-package.yml

@@ -4,16 +4,6 @@
     name: "{{ certbot_package }}"
     state: present
 
-- name: Install Certbot dependencies.
-  package:
-    name: "{{ cert_item }}"
-    state: present
-  when:
-    - certbot_create_method in certbot_create_packages
-  loop: "{{ certbot_create_packages[certbot_create_method] }}"
-  loop_control:
-    loop_var: cert_item
-
 - name: Set Certbot script variable.
   set_fact:
     certbot_script: "{{ certbot_package }}"

tasks/main.yml

@@ -13,17 +13,6 @@
 - import_tasks: install-from-source.yml
   when: certbot_install_method == 'source'
 
-- name: Cloudflare API token
-  ansible.builtin.template:
-    src: dnscloudflare.ini.j2
-    dest: "/etc/letsencrypt/dnscloudflare.ini"
-    owner: root
-    group: root
-    mode: '0600'
-  when:
-    - certbot_create_method == 'dns-cloudflare'
-  become: true
-
 - include_tasks: create-cert-standalone.yml
   with_items: "{{ certbot_certs }}"
   when:
@@ -40,21 +29,5 @@
   loop_control:
     loop_var: cert_item
 
-- include_tasks: create-cert-nginx.yml
-  with_items: "{{ certbot_certs }}"
-  when:
-    - certbot_create_if_missing
-    - certbot_create_method == 'nginx'
-  loop_control:
-    loop_var: cert_item
-
-- include_tasks: create-cert-dns-cloudflare.yml
-  with_items: "{{ certbot_certs }}"
-  when:
-    - certbot_create_if_missing
-    - certbot_create_method == 'dns-cloudflare'
-  loop_control:
-    loop_var: cert_item
-
 - import_tasks: renew-cron.yml
   when: certbot_auto_renew

tasks/setup-RedHat.yml

@@ -9,3 +9,4 @@
   shell: |
     dnf config-manager --set-enabled crb
   changed_when: false
+  when: ansible_distribution != 'Fedora'

templates/dnscloudflare.ini.j2

@@ -1 +0,0 @@
-dns_cloudflare_api_token = {{ certbot_dns_cloudflare_api_token }}

vars/default.yml

@@ -1,7 +1,2 @@
 ---
 certbot_package: certbot
-certbot_create_packages:
-  nginx:
-    - python3-certbot-nginx
-  'dns-cloudflare':
-    - python3-certbot-dns-cloudflare