- name: Letsencrypt
  hosts: beepi
  become: true
  vars:
    njalla_api_token: !vault |
              $ANSIBLE_VAULT;1.1;AES256
              65666463616462633533663835383164353566326437333336616266333864333465613732346633
              6534633837373937393563633966343738316562653930610a346461613236653266303237306663
              66663234313832373939346539386633316465373861663862646537303662313564363038303164
              3865666132613130380a623737663837343438333837626338346565653735613435313164373663
              33316231366334623461303263386136656234613133373361353262346366636133396134663838
              3733353465643235653337306434396366623935303862633737

  tasks:
    - name: Install Certbot
      ansible.builtin.apt:
        name:
          - python3-certbot-nginx
          - python3-pip
        state: present

    - name: Install Njalla DNS plugin
      ansible.builtin.pip:
        name: certbot-dns-njalla
        state: present
        extra_args: --break-system-packages

    - name: Request root certificates
      changed_when: true
      ansible.builtin.command: "certbot certonly --nginx -m secretbumblebee@proton.me --agree-tos -n --domains {{ item }}"
      loop:
        - secretbee.buzz
        - git.secretbee.buzz
        - grafana.secretbee.buzz
        - mail.secretbee.buzz
        - matrix.secretbee.buzz
        - gallery.secretbee.buzz
        - ott.secretbee.buzz

    - name: Copy njalla credentials
      ansible.builtin.copy:
        dest: /etc/letsencrypt/njalla.ini
        content: "dns_njalla_token={{ njalla_api_token }}\n"
        owner: root
        group: root
        mode: '0600'

    - name: Request vault certificate
      changed_when: true
      ansible.builtin.command: >-
        certbot certonly -a dns-njalla
        --dns-njalla-credentials /etc/letsencrypt/njalla.ini
        -m secretbumblebee@proton.me --agree-tos -n
        --domains vault.secretbee.buzz

    - name: Change permission on live
      ansible.builtin.file:
        path: /etc/letsencrypt/live/
        mode: '0711'

    - name: Change permission on archive
      ansible.builtin.file:
        path: /etc/letsencrypt/archive/
        mode: '0711'