ansible-personal/roles/nginx/tasks/letsencrypt.yml

---

# Use acme.sh instead of certbot because they only support installation via
# snap now.
- block:
  - name: Remove certbot
    ansible.builtin.apt:
      name: certbot
      state: absent

  - name: Remove old certbot post and pre hooks for nginx
    ansible.builtin.file:
      dest: "{{ item }}"
      state: absent
    with_items:
      - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
      - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh

  - name: Check if acme.sh is installed
    ansible.builtin.stat:
      path: "{{ letsencrypt_acme_home }}"
    register: acme_home

  - name: Download acme.sh
    ansible.builtin.get_url:
      url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
      dest: "{{ letsencrypt_acme_script_temp }}"
      mode: 0700
    register: acme_download
    when: not acme_home.stat.exists

  # Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
  # have to chdir to the /root directory where the script exists or else it
  # fails. Ansible runs it, but the script can't find itself...).
  - name: Install acme.sh
    ansible.builtin.command:
      cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
      creates: "{{ letsencrypt_acme_home }}/acme.sh"
      chdir: /root
    register: acme_install
    when: acme_download is changed

  - name: Remove temporary acme.sh script
    ansible.builtin.file:
      dest: "{{ letsencrypt_acme_script_temp }}"
      state: absent
    when:
      - acme_install.rc is defined
      - acme_install.rc == 0

  - name: Set default certificate authority for acme.sh
    ansible.builtin.command:
      cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"

  - name: Prepare Let's Encrypt well-known directory
    ansible.builtin.file:
      state: directory
      path: /var/lib/letsencrypt/.well-known
      owner: root
      group: nginx
      mode: g+s

  - name: Copy systemd service to renew Let's Encrypt certs
    ansible.builtin.template:
      src: renew-letsencrypt.service.j2
      dest: /etc/systemd/system/renew-letsencrypt.service
      mode: 0644
      owner: root
      group: root

  - name: Copy systemd timer to renew Let's Encrypt certs
    ansible.builtin.copy:
      src: renew-letsencrypt.timer
      dest: /etc/systemd/system/renew-letsencrypt.timer
      mode: 0644
      owner: root
      group: root

  # always issues daemon-reload just in case the service/timer changed
  - name: Start and enable systemd timer to renew Let's Encrypt certs
    ansible.builtin.systemd:
      name: renew-letsencrypt.timer
      state: started
      enabled: true
      daemon_reload: true

  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '=='))
        or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
  tags: letsencrypt

# vim: set ts=2 sw=2: