#!/usr/bin/ansible-playbook
# vim:ft=ansible:
---
- name: "Register certificate for {{ website_url }}"
  block:
    - name: Install SSL-required packages
      apt:
        name: python-openssl
    - name: Set up PKI filesystem hierarchy
      file:
        path: "{{ item.dir }}"
        mode: "{{ item.mode }}"
        owner: root
        group: www-data
        state: directory
      loop:
        - { dir: "/etc/pki", mode: "0750" }
        - { dir: "/etc/pki/cert", mode: "0750" }
        - { dir: "/etc/pki/cert/crt", mode: "0750" }
        - { dir: "/etc/pki/cert/csr", mode: "0750" }
        - { dir: "/etc/pki/cert/private", mode: "0750" }
    - name: Create ACME account key
      openssl_privatekey:
        path: "/etc/pki/cert/private/account.key"
    - name: Create certificate key
      openssl_privatekey:
        path: "/etc/pki/cert/private/{{ website_url }}.key"
        mode: "0750"
    - name: Create CSR
      openssl_csr:
        path: "/etc/pki/cert/csr/{{ website_url }}.csr"
        common_name: "{{ website_url }}"
        privatekey_path: /etc/pki/cert/private/{{ website_url }}.key
        email_address: "rehashedsalt@cock.li"
    - name: Create challenge for CSR
      acme_certificate:
        acme_directory: "{{ acme_directory }}"
        acme_version: 2
        terms_agreed: yes
        account_email: "rehashedsalt@cock.li"
        account_key: "/etc/pki/cert/private/account.key"
        csr: "/etc/pki/cert/csr/{{ website_url }}.csr"
        dest: "/etc/pki/cert/crt/{{ website_url }}.crt"
        fullchain_dest: "/etc/pki/cert/crt/{{ website_url }}-fullchain.crt"
      register: com_challenge
    - name: Fulfill challenge
      block:
      - name: Reload Apache
        service:
          name: apache2
          state: reloaded
      - name: Create well-known directory
        file:
          path: "{{ website_webroot }}/.well-known/acme-challenge"
          mode: "0755"
          recurse: yes
          state: directory
      - name: Copy challenge files
        copy:
          dest: "{{ website_webroot }}/{{ com_challenge['challenge_data'][website_url]['http-01']['resource'] }}"
          content: "{{ com_challenge['challenge_data'][website_url]['http-01']['resource_value'] }}"
      - name: Create certificate
        acme_certificate:
          acme_directory: "{{ acme_directory }}"
          acme_version: 2
          account_key: /etc/pki/cert/private/account.key
          csr: "/etc/pki/cert/csr/{{ website_url }}.csr"
          dest: "/etc/pki/cert/crt/{{ website_url }}.crt"
          fullchain_dest: "/etc/pki/cert/crt/{{ website_url }}-fullchain.crt"
          chain_dest: "/etc/pki/cert/crt/{{ website_url }}-intermediate.crt"
          data: "{{ com_challenge }}"
      - name: Clean up
        file:
          path: "{{ website_webroot }}/.well-known"
          state: absent
      when: com_challenge is changed
  become: yes