tasks/deployer.yml

@@ -1,24 +1,15 @@
 ---
 - name: "Deployer - Certbot - Renew Certificates"
-  containers.podman.podman_container:
-    name: certbot
-    image: "docker.io/certbot/certbot:latest"
-    state: started
-    network: host
-    volumes:
-      - "{{ ansible_facts.user_dir }}/data/certbot:/etc/letsencrypt"
-    command: "renew"
-    detach: false
+  command: "certbot renew --config-dir ~/data/letsencrypt/config --logs-dir ~/data/letsencrypt/logs --work-dir ~/data/letsencrypt/work"
   register: task
-  changed_when:
-    - task.stdout.find("No renewals were attempted.") == -1
+  changed_when: task.stdout.find("No renewals were attempted.") == -1
   tags:
     - certbot
     - tls
 
 - name: "Deployer - Certbot - Copy Certificates"
   copy:
-    src: "~/data/certbot/live/{{ cert }}/"
+    src: "~/data/letsencrypt/live/{{ cert }}/"
     dest: "~/data/certificates/{{ cert }}/"
     follow: true
   loop: "{{ certs }}"

tasks/installer.yml

@@ -61,35 +61,42 @@
     label: "{{ library }}"
     loop_var: "library"
 
-- name: "Installer : Certbot : Auth Hook - Create Folder"
-  file:
-    path: ~/data/certbot/auth-hooks
-    state: directory
+- name: "Installer : Certbot : Install"
+  pip:
+    name: certbot
+    state: latest
+    extra_args: --upgrade
+    virtualenv: ~/.venv/ansible
+    virtualenv_command: "python3 -m venv"
   tags:
     - certbot
 
-- name: "Installer : Certbot : Auth Hook - Download"
+- name: "Installer : Certbot : Create Symbolic Links"
+  ansible.builtin.file:
+    src: ~/.venv/ansible/bin/{{ binary }}
+    dest: ~/bin/{{ binary }}
+    state: link
+  vars:
+    binaries:
+      - certbot
+  loop: "{{ binaries }}"
+  loop_control:
+    label: "{{ binary }}"
+    loop_var: "binary"
+  tags:
+    - certbot
+
+- name: "Installer : Certbot : Auth Hook"
   get_url:
     url: "https://git.waren.io/warengroup/acme-dns-auth/raw/branch/master/acme-dns-auth.py"
-    dest: "~/data/certbot/auth-hooks/acme-dns.py"
+    dest: "~/data/letsencrypt/config/renewal-hooks/pre/acme-dns-auth.py"
     mode: '700'
     force: true
   tags:
     - certbot
 
 - name: "Installer : Certbot : Create Certificates"
-  containers.podman.podman_container:
-    name: certbot
-    image: "docker.io/certbot/certbot:latest"
-    state: started
-    network: host
-    volumes:
-      - "{{ ansible_facts.user_dir }}/data/certbot:/etc/letsencrypt"
-    command: "certonly --cert-name {{ cert.name }} --manual --preferred-challenges dns-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook /etc/letsencrypt/auth-hooks/acme-dns.py --debug-challenges --key-type rsa -d {{ cert.domains | join(' -d ') }}"
-    detach: false
-  register: task
-  changed_when:
-    - task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
+  command: "certbot certonly --cert-name {{ cert.name }} --manual --preferred-challenges dns-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook ~/data/letsencrypt/config/renewal-hooks/pre/acme-dns-auth.py --debug-challenges --preferred-chain='ISRG Root X1' --key-type rsa -d {{ cert.domains | join(' -d ') }} --config-dir ~/data/letsencrypt/config --logs-dir ~/data/letsencrypt/logs --work-dir ~/data/letsencrypt/work"
   loop: "{{ certs }}"
   loop_control:
     label: "{{ cert.name }}"
@@ -100,12 +107,14 @@
         email: mattez02.contact@gmail.com
         domains:
           - arcadiamc.wgi.fi
+  register: task
+  changed_when: task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
   tags:
     - certbot
 
 - name: "Installer : Schedule : Maintenance"
   cron:
-    name: "Matte - Infra - Maintenance"
+    name: "Matte - Maintenance"
     hour: "*/3"
     minute: "0"
     job: "~/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/infra -d ~/.ansible/pull/matte/infra --accept-host-key --private-key ~/.ssh/keys/matte/infra --vault-password-file ~/.ansible/vault/matte.yml tasks.yml -t maintenance"
@@ -114,7 +123,7 @@
 
 - name: "Installer : Schedule : Deployer"
   cron:
-    name: "Matte - Infra - Deployer"
+    name: "Matte - Deployer"
     minute: "*/5"
     job: "~/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/infra -d ~/.ansible/pull/matte/infra --accept-host-key --private-key ~/.ssh/keys/matte/infra --vault-password-file ~/.ansible/vault/matte.yml tasks.yml -t deployer"
   tags: