Finish up the role. Allow forcing of certificate renewals, and do not try to re-issue a cert under normal circumstances

1 files changed, 26 insertions, 2 deletions

diff --git a/tasks/main.yml b/tasks/main.yml
index b3c0570..b788abb 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -63,18 +63,42 @@
       #!/bin/sh
       set -e
       set -x
+      cd '{{acmesh_user.home}}'
       {{acmesh_env}}
 
       . $HOME/install/acme.sh.env
 
+      force=""
+      if [ "{{acmesh_force}}" -eq 1 ] ; then
+        force="--force"
+      fi
+
       {% for item in acmesh_domains %}
+      if ! [ -d "certs/{{item}}" ] || ! [ -z "$force" ] ; then
       acme.sh {{acmesh_flags | replace('\n', ' ')}} \
+          $force \
           --issue \
           --dns dns_aws \
           --challenge-alias "{{acmesh_delegation_domain}}" \
           -d "{{item}}" -d "*.{{item}}"
+      fi
       {% endfor %}
 
     dest: '{{acmesh_user.home}}/issue.sh'
-
-# - name: Issue certificates
+    mode: 0500
+    owner: '{{acmesh_user.name}}'
+  register: issue_script
+- name: Run issue script
+  shell: |
+    #!/bin/sh
+    echo '{{acmesh_user.home}}/issue.sh' | su -s /bin/sh '{{acmesh_user.name}}'
+  when: issue_script.changed
+# acme.sh should install a cron job automatically, in the event it does not
+# you should be able to use a task like this
+# - name: Install cron job for renewals
+#   cron:
+#     name: "letsencrypt / acme cron"
+#     job: '{{acmesh_user.home}}/install/acme.sh --cron >> {{acmesh_user.home}}/conf {{acmesh_user.home}}/renewals.log'
+#     hour: '0'
+#     minute: '0'
+#     user: '{{acmesh_user.name}}'