ansible-role-certbot/tasks/create-cert-standalone.yml

---
- name: Check if certificate already exists.
  stat:
    path: >-
      /etc/letsencrypt/live/{% if certbot_cert_name %}{{ certbot_cert_name }}
      {% else %}{{ cert_item.domains | first | replace('*.', '') }}
      {% endif %}/cert.pem
  register: letsencrypt_cert

- name: Ensure pre and post hook folders exist.
  file:
    path: /etc/letsencrypt/renewal-hooks/{{ item }}
    state: directory
    mode: 0755
    owner: root
    group: root
  with_items:
    - pre
    - post

- name: Create pre hook to stop services.
  template:
    src: stop_services.j2
    dest: /etc/letsencrypt/renewal-hooks/pre/stop_services
    owner: root
    group: root
    mode: 0750
  when:
    - certbot_create_standalone_stop_services is defined
    - certbot_create_standalone_stop_services

- name: Create post hook to start services.
  template:
    src: start_services.j2
    dest: /etc/letsencrypt/renewal-hooks/post/start_services
    owner: root
    group: root
    mode: 0750
  when:
    - certbot_create_standalone_stop_services is defined
    - certbot_create_standalone_stop_services

- name: Generate new certificate if one doesn't exist.
  command: "{{ certbot_create_command }}"
  when: not letsencrypt_cert.stat.exists or certbot_force

- name: Generate Diffie-Hellman parameters
  openssl_dhparam:
    path: /etc/letsencrypt/ssl-dhparams.pem
    size: 2048

- name: ensure conf.d exist
  file:
    mode: 0750
    path: "{{ certbot_nginx_conf_path }}"
    state: directory

- name: create nginx config ssl file
  template:
    mode: 0750
    dest: >-
      {{ certbot_nginx_conf_path }}/
      {% if certbot_cert_name %}{{ certbot_cert_name }}
      {% else %}
      {{ cert_item.domains | first | replace('*.', '') }}
      {% endif %}.ssl"
    src: nginx_ssl_config.j2