self-hosting/roles/certbot/tasks/main.yml

---
- name: Install certbot
  become: true
  apt:
    name: certbot
    state: present
    update_cache: yes

- name: Create acme directory
  become: true
  file:
    path: /var/www/acme
    state: directory
    mode: 0755

- name: Enable modules
  become: true
  apache2_module:
    name: "{{ item }}"
    state: present
  with_items:
    - rewrite
    - ssl
  notify: Reload apache2 service

- name: Copy apache confs
  become: true
  copy: src={{ item.src }} dest={{ item.dest }}
  with_items:
    - { src: 'acme.conf', dest: '/etc/apache2/conf-available/acme.conf' }
    - { src: 'ssl-options.conf', dest: '/etc/apache2/conf-available/ssl-options.conf' }


- name: Enable apache confs
  become: true
  command: a2enconf {{ item }}
  with_items:
    - acme
    - ssl-options
  register: result
  changed_when: "'already enabled' not in result.stdout"
  notify: Reload apache2 service

- name: Allow certbot renewal
  become: true
  copy:
    src: http-certbot.conf
    dest: /etc/nftables/input.d/http-certbot.conf
  notify: Reload nftables service

- name: Allow incoming HTTPS
  become: true
  copy:
    src: https.conf
    dest: /etc/nftables/input.d/https.conf
  notify: Reload nftables service