--- # Use acme.sh instead of certbot because they only support installation via # snap now. - block: - name: Remove certbot apt: name: certbot state: absent - name: Remove old certbot post and pre hooks for nginx file: dest: "{{ item }}" state: absent with_items: - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh - name: Download acme.sh get_url: url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh dest: "{{ letsencrypt_acme_script }}" mode: 0700 - name: Prepare Let's Encrypt well-known directory file: state: directory path: /var/lib/letsencrypt/.well-known owner: root group: nginx mode: g+s - name: Copy systemd service to renew Let's Encrypt certs template: src: renew-letsencrypt.service.j2 dest: /etc/systemd/system/renew-letsencrypt.service mode: 0644 owner: root group: root - name: Copy systemd timer to renew Let's Encrypt certs copy: src: renew-letsencrypt.timer dest: /etc/systemd/system/renew-letsencrypt.timer mode: 0644 owner: root group: root # always issues daemon-reload just in case the service/timer changed - name: Start and enable systemd timer to renew Let's Encrypt certs systemd: name: renew-letsencrypt.timer state: started enabled: yes daemon_reload: yes when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==')) tags: letsencrypt # vim: set ts=2 sw=2: