acme.sh.yml

---

- hosts: homelab:octopi

  vars:
    application: acme.sh

    cert_cloudflare_email: "{{ cloudflare_email }}"
    cert_cloudflare_api_token: "{{ cloudflare_api }}"

  tasks:
    - name: Create config folder
      ansible.builtin.file:
        path: "{{ config_directory }}"
        state: directory
        owner: "{{ common_root_id }}"
        group: "{{ common_root_group }}"
        mode: "0700"

    - name: Update apt cache
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 600
      changed_when: false

    # https://github.com/Neilpang/acme.sh/wiki/How-to-install
    - name: Install socat
      ansible.builtin.apt:
        name: socat
        state: present

    - name: Download Neilpang's acme.sh
      ansible.builtin.git:
        repo: https://github.com/acmesh-official/acme.sh.git
        dest: "{{ config_directory }}/repo"
        version: 3.0.7

    - name: Setup acme.sh
      ansible.builtin.shell: |
        ./acme.sh --install \
        --home "{{ config_directory }}/install" \
        --config-home "{{ config_directory }}/config" \
        --cert-home "{{ config_directory }}/certs" \
        --accountemail "{{ common_email_username }}" \
        --log "{{ config_directory }}/{{ application }}.log"
      args:
        chdir: "{{ config_directory }}/repo"
        executable: "/bin/bash"
      changed_when: false

    - name: Create scripts directories
      ansible.builtin.file:
        path: "{{ config_directory }}/scripts"
        state: directory
        owner: "{{ common_root_id }}"
        group: "{{ common_root_group }}"
        mode: "0775"

    - name: Copy scripts
      ansible.builtin.template:
        src: "{{ files_directory }}/{{ item.script }}"
        dest: "{{ config_directory }}/scripts/{{ item.script }}"
        mode: "0755"
      loop: "{{ cert_domains }}"

    - name: Setup Cloudflare creds
      ansible.builtin.lineinfile:
        path: "{{ config_directory }}/config/account.conf"
        regex: "{{ item.regex }}"
        line: "{{ item.line }}"
      loop:
        - regex: "^SAVED_CF_Key"
          line: "SAVED_CF_Key='{{ cert_cloudflare_api_token }}'"
        - regex: "^SAVED_CF_Email"
          line: "SAVED_CF_Email='{{ cert_cloudflare_email }}'"

    - name: Generate certs for each domain
      ansible.builtin.shell: |
        /bin/bash -ic \
          ". acme.sh.env && acme.sh \
          --issue \
          {{ item.method }} \
          --keylength {{ item.keylength }} \
          --domain {{ item.domain }} \
          --post-hook '{{ config_directory }}/scripts/{{ item.script }} {{ item.script_args }}'"
      args:
        chdir: "{{ config_directory }}/install"
        executable: /bin/bash
      register: result
      loop: "{{ cert_domains }}"
      failed_when: result.rc == 1 or result.rc == 127
      changed_when: result.rc == 0