Ansible Role: certbot

DISCLAIMER

After this announcement I will not test on RHEL anymore.

---

A minimal role to install certbot and cloudflare DNS plugin.

Requirements

In RHEL distribution the needed packages are in the epel repository.

Role Variables

certbot_config_file: cli.ini.j2

Default template file used for the global certbot configuration: can be overwritten if needed.

certbot_keytype: ecdsa
certbot_curve: secp384r1
certbot_mail: TBD

Configuration values used in the default configuration files.

certbot_hooks: []
# - name: restart-nginx.sh
#   type: deploy

List of template files containing renewal hooks. The type is one of: deploy, pre, post.

certbot_cloudflare_enabled: true

Whether to instal and configure the cloudflare plugin

certbot_cloudflare_config_dir: /root/.secrets

The parent direcotry for the cloudflare plugin configuration file. The filename is cloudflare.ini

certbot_cloudflare_token: TBD

The Cloudflare token used in the DNS challenge.

Distro specific variables:

# Debian
certbot_package: certbot
certbot_cloudflare_package: python3-certbot-dns-cloudflare
certbot_renew_timer: certbot.timer
# RHEL
certbot_package: certbot
certbot_cloudflare_package: python3-certbot-dns-cloudflare
certbot_renew_timer: certbot-renew.timer

Dependencies

None.

Example Playbook

- name: Converge
  hosts: all
  vars:
    certbot_mail: [email protected]
    certbot_cloudflare_token: supersecrettoken
  tasks:
    - name: Include certbot.
      ansible.builtin.include_role:
        name: alecunsolo.certbot

License

MIT

Notes

Testing with molecule is stolen from heavily inspired by Jeff Geerling. Watch his video (and the other ones as well).