stuff

playbooks/letsencrypt/letsencrypt.yml

@@ -1,12 +1,30 @@
 - name: Letsencrypt
   hosts: beepi
   become: true
+  vars:
+    njalla_api_token: !vault |
+              $ANSIBLE_VAULT;1.1;AES256
+              65666463616462633533663835383164353566326437333336616266333864333465613732346633
+              6534633837373937393563633966343738316562653930610a346461613236653266303237306663
+              66663234313832373939346539386633316465373861663862646537303662313564363038303164
+              3865666132613130380a623737663837343438333837626338346565653735613435313164373663
+              33316231366334623461303263386136656234613133373361353262346366636133396134663838
+              3733353465643235653337306434396366623935303862633737
+
   tasks:
     - name: Install Certbot
       ansible.builtin.apt:
-        name: python3-certbot-nginx
+        name:
+          - python3-certbot-nginx
+          - python3-pip
         state: present
 
+    - name: Install Njalla DNS plugin
+      ansible.builtin.pip:
+        name: certbot-dns-njalla
+        state: present
+        extra_args: --break-system-packages
+
     - name: Request root certificates
       changed_when: true
       ansible.builtin.command: "certbot certonly --nginx -m secretbumblebee@proton.me --agree-tos -n --domains {{ item }}"
@@ -19,6 +37,22 @@
         - gallery.secretbee.buzz
         - ott.secretbee.buzz
 
+    - name: Copy njalla credentials
+      ansible.builtin.copy:
+        dest: /etc/letsencrypt/njalla.ini
+        content: "dns_njalla_token={{ njalla_api_token }}\n"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Request vault certificate
+      changed_when: true
+      ansible.builtin.command: >-
+        certbot certonly -a dns-njalla
+        --dns-njalla-credentials /etc/letsencrypt/njalla.ini
+        -m secretbumblebee@proton.me --agree-tos -n
+        --domains vault.secretbee.buzz
+
     - name: Change permission on live
       ansible.builtin.file:
         path: /etc/letsencrypt/live/