ansible/roles/letsencrypt/tasks/main.yml

- name: Generate (or renew) the certificate
  delegate_to: certgetter01.phx2.fedoraproject.org
  command: certbot certonly --keep -n --webroot --webroot-path /var/www/html/ -d {{','.join([site_name] + server_aliases)}}
  run_once: true
  register: certbot_output
  check_node: no
  changed_when: "not ('not yet due for renewal' in certbot_output.stderr)"
  tags:
  - letsencrypt

# And once we do that, we need to copy some things.
- name: Obtain the certificate
  delegate_to: certgetter01.phx2.fedoraproject.org
  command: cat /etc/letsencrypt/live/{{site_name}}/cert.pem
  register: certbot_certificate
  when: "not ('not yet due for renewal' in certbot_output.stderr)"
  tags:
  - letsencrypt

- name: Obtain the intermediate certificate
  delegate_to: certgetter01.phx2.fedoraproject.org
  command: cat /etc/letsencrypt/live/{{site_name}}/chain.pem
  register: certbot_chain
  when: "not ('not yet due for renewal' in certbot_output.stderr)"
  tags:
  - letsencrypt

- name: Obtain the key
  delegate_to: certgetter01.phx2.fedoraproject.org
  command: cat /etc/letsencrypt/live/{{site_name}}/privkey.pem
  register: certbot_key
  when: "not ('not yet due for renewal' in certbot_output.stderr)"
  tags:
  - letsencrypt

- name: Install the certificate
  copy: >
    dest=/etc/pki/tls/certs/{{site_name}}.cert
    content="{{certbot_certificate.stdout}}"
    owner=root
    group=root
    mode=0644
  when: "not ('not yet due for renewal' in certbot_output.stderr)"
  notify:
  - reload proxyhttpd
  tags:
  - letsencrypt

- name: Install the intermediate/chain certificate
  copy: >
    dest=/etc/pki/tls/certs/{{site_name}}.intermediate.cert
    content="{{certbot_chain.stdout}}"
    owner=root
    group=root
    mode=0644
  when: "not ('not yet due for renewal' in certbot_output.stderr)"
  notify:
  - reload proxyhttpd
  tags:
  - letsencrypt

- name: Install the key
  copy: >
    dest=/etc/pki/tls/private/{{site_name}}.key
    content="{{certbot_key.stdout}}"
    owner=root
    group=root
    mode=0600
  when: "not ('not yet due for renewal' in certbot_output.stderr)"
  notify:
  - reload proxyhttpd
  tags:
  - letsencrypt