servers/roles/nginx/tasks/main.yml

- name: Install packages
  package:
    name:
      - certbot
      - nginx

- name: Create HTTP server directories
  file:
    path: /srv/http/.well-known
    recurse: true
    state: directory
    owner: nginx
    group: nginx

- name: Set up default HTTP server
  copy:
    dest: /etc/nginx/http.d
    src: default.conf
  notify: reload nginx

- name: Enable nginx service
  service:
    name: nginx
    enabled: true
    state: started

- name: Get LE certificate
  command:
    cmd: certbot certonly --non-interactive --agree-tos --register-unsafely-without-email --webroot --webroot-path /srv/http -d {{ tls_domains|default([dns_name])|join(',') }}
    creates: '/etc/letsencrypt/renewal/{{ tls_domains|default([dns_name])|first }}.conf'

- name: Install certificate renewal deployment hook
  copy:
    dest: /etc/letsencrypt/renewal-hooks/deploy/
    src: reload-nginx.sh
    mode: 0755

- name: Enable certbot renewal
  cron:
    name: "certbot renew"
    job: "certbot renew --quiet"
    user: root
    hour: "2,14"
    minute: "18"