feat: add hook script and port

CHANGELOG.md

@@ -5,6 +5,11 @@ Which is based on [Keep A Changelog](http://keepachangelog.com/)
 
 ## Unreleased
 
+### Added
+
+- feat: add certbot_port variable
+- feat: add hook scripts
+
 ## v2.2.0 - 2021-08-24
 
 ### Added

README.md

@@ -7,17 +7,24 @@ Generate certificate SSL with certbot.
 
 ## Requirements
 
-* Ansible >= 2.9
+* Ansible >= 2.10
 * Debian
-  * Buster
   * Bullseye
 
 ## Role variables
 
 - `certbot_mail` - mail address used by let's encrypt to notify
 - `certbot_key_size` - private key size (default: `4096`)
+- `certbot_port` - port to listen for certbot web (default: `80`)
 - `certbot_path` - path where certbot write temporary files(default: `/var/www/acme`)
-- `certbot_domains` - array with the domain name and command
+- `certbot_domains` - dict with the domain name and the script
+
+```
+  website.com:
+    #!/bin/bash
+    echo "test" > /tmp/log
+```
+
 - `certbot_role` - string must be master or slave, if master generate the certificates
 
 ## How to use
@@ -37,7 +44,6 @@ Generate certificate SSL with certbot.
 * install molecule and dependencies `pip3 install molecule molecule-docker docker ansible-lint pytest-testinfra yamllint`
 * run `molecule test`
 
-
 ## License
 
 ```

defaults/main.yml

@@ -1,6 +1,7 @@
 ---
 certbot_mail: ssl@host.local
 certbot_key_size: 4096
+certbot_port: 80
 certbot_path: /var/www/acme
 certbot_role: master
-certbot_domains: []
+certbot_domains: {}

meta/main.yml

@@ -1,15 +1,15 @@
 ---
 galaxy_info:
   role_name: certbot
+  namespace: nishiki
   author: Adrien Waksberg
   company: Adrien Waksberg
   description: Generate certificate SSL with certbot
   license: Apache2
-  min_ansible_version: 2.9
+  min_ansible_version: 2.10
   platforms:
     - name: Debian
       versions:
-        - buster
         - bullseye
 
   galaxy_tags:

tasks/base.yml

@@ -17,22 +17,16 @@
     state: directory
   tags: certbot
 
-- name: install certbot-renew binary
+- name: install hooks script
   ansible.builtin.copy:
-    src: certbot-renew
+    content: '{{ item.value|default("#!/bin/bash") }}'
-    dest: /usr/local/bin/certbot-renew
+    dest: '/etc/letsencrypt/hook-{{ item.key }}'
     owner: root
     group: root
-    mode: 0755
+    mode: 0700
-  tags: certbot
+  loop: '{{ certbot_domains|dict2items }}'
-
+  loop_control:
-- name: install certbot renew configuration
+    label: '{{ item.key }}'
-  ansible.builtin.template:
-    src: renew.cfg.j2
-    dest: /etc/letsencrypt/renew.cfg
-    owner: root
-    group: root
-    mode: 0644
   tags: certbot
 
 - name: remove old cerbot renew cron
@@ -47,5 +41,5 @@
     user: root
     hour: '*/12'
     minute: '0'
-    job: perl -e 'sleep int(rand(3600))' && certbot -q renew --renew-hook /usr/local/bin/certbot-renew
+    job: perl -e 'sleep int(rand(3600))' && certbot -q renew
   tags: certbot

tasks/certificates.yml

@@ -1,32 +1,40 @@
 ---
 - name: check if certificate exist
   ansible.builtin.stat:
-    path: '/etc/letsencrypt/live/{{ item.name }}'
+    path: '/etc/letsencrypt/live/{{ item.key }}'
-  loop: '{{ certbot_domains }}'
+  loop: '{{ certbot_domains|dict2items }}'
+  loop_control:
+    label: '{{ item.key }}'
   register: st
   tags: certbot
 
-- name: check if a webservice is started on port 80
+- name: check if a webservice is started
   ansible.builtin.wait_for:
-    port: 80
+    port: '{{ certbot_port }}'
     state: started
-    timeout: 5
+    timeout: 2
   ignore_errors: true
   register: web
   tags: certbot
 
 - name: create a new certificate
   ansible.builtin.command: >
-    certbot certonly -n --agree-tos -d {{ item.item.name }} -m {{ certbot_mail }}
+    certbot certonly -n --agree-tos -d {{ item.item.key }} -m {{ certbot_mail }}
     --webroot --webroot-path {{ certbot_path }} --rsa-key-size {{ certbot_key_size }}
+    --deploy-hook /etc/letsencrypt/hook-{{ item.item.key }}
   loop: '{{ st.results }}'
+  loop_control:
+    label: '{{ item.item.key }}'
   when: (certbot_role == 'master' or item.item.name == ansible_fqdn) and not item.stat.exists and not web.failed
   tags: certbot
 
 - name: create a new certificate (standalone)
   ansible.builtin.command: >
-    certbot certonly -n --agree-tos -d {{ item.item.name }} -m {{ certbot_mail }}
+    certbot certonly -n --agree-tos -d {{ item.item.key }} -m {{ certbot_mail }}
-    --standalone --rsa-key-size {{ certbot_key_size }}
+    --standalone --rsa-key-size {{ certbot_key_size }} --deploy-hook /etc/letsencrypt/hook-{{ item.item.key }}
+    --http-01-port {{ certbot_port }}
   loop: '{{ st.results }}'
+  loop_control:
+    label: '{{ item.item.key }}'
   when: (certbot_role == 'master' or item.item.name == ansible_fqdn) and not item.stat.exists and web.failed
   tags: certbot