- name: Create Ansible facts directory
  ansible.builtin.file:
    path: /etc/ansible/facts.d
    state: directory
    recurse: true

- name: Install certbot facts script
  register: certbot_fact_script
  ansible.builtin.copy:
    src: certbot.fact
    dest: /etc/ansible/facts.d/certbot.fact
    mode: "775"

- name: Re-gather custom facts
  when: certbot_fact_script is changed
  ansible.builtin.setup:
    filter: ansible_local

- name: Install certbot and certbot-dns-ovh
  community.general.apk:
    name:
      - certbot
      - certbot-dns-ovh

- name: Renew all TLS certificates that are near expiry
  when: ( ansible_local.certbot.invalid_certificates | length ) > 0
  ansible.builtin.shell:
    certbot renew --non-interactive

- name: Install OVH DNS credentials
  ansible.builtin.copy:
    src: ovh-dns-credentials.ini
    dest: /etc/ovh-dns-credentials.ini
    mode: "400"

- name: Install missing TLS certificates
  loop: "{{ subdomains }}"
  when: not ( ( item.name ~ ".joeac.net" ) in ansible_local.certbot.certificates )
  ansible.builtin.shell:
    certbot certonly \
     	--dns-ovh \
      --dns-ovh-credentials /etc/ovh-dns-credentials.ini \
     	--cert-name {{ item.name }}.joeac.net \
     	--domain {{ item.full_domain }} \
     	--non-interactive

- name: Add joeac.net group
  ansible.builtin.group:
    name: joeac.net

- name: Add tls group
  ansible.builtin.group:
    name: tls

- name: Add joeac.net user
  ansible.builtin.user:
    name: joeac.net
    group: joeac.net
    groups:
      - tls
    append: false

- name: Give ownership of /etc/letsencrypt to joeac.net:tls
  ansible.builtin.file:
    path: /etc/letsencrypt
    owner: joeac.net
    group: tls
    mode: g+rwx
    recurse: true

- name: Install daily crontab to renew TLS certificates
  ansible.builtin.cron:
    special_time: daily
    name: daily crontab to renew all TLS certificates near to expiry
    job:
      certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt