rewrite lego role

roles/lego/tasks/main.yml

@@ -1,14 +1,21 @@
 ---
-
 - name: Get latest lego version
-  github_release:
-    user: go-acme
-    repo: lego
-    action: latest_release
-    token: "{{ vault_github_token }}"
+  become: false
   delegate_to: localhost
   run_once: true
-  register: lego_version
+  when: lego_version is undefined
+  block:
+    - name: Get latest version from Github
+      github_release:  # needs Python Module github3.py
+        user: go-acme
+        repo: lego
+        action: latest_release
+        token: "{{ vault_github_token }}"
+      register: lego_github_version
+
+    - name: "{{ lego_github_version }}"
+      set_fact:
+        lego_version: "{{ lego_github_version.tag }}"
 
 - name: Set architecture alias
   set_fact:
@@ -20,10 +27,10 @@
     architecture_alias: "arm64"  # noqa: var-naming[no-role-prefix]
   when: ansible_architecture == "aarch64"
 
-- name: "Download lego from GitHub ({{ lego_version.tag }})"
+- name: "Download lego from GitHub"
   get_url:
     url: "https://github.com/go-acme/lego/releases/download/\
-          {{ lego_version.tag }}/lego_{{ lego_version.tag }}\
+          {{ lego_version }}/lego_{{ lego_version }}\
           _linux_{{ architecture_alias }}.tar.gz"
     dest: "/var/tmp/lego.tar.gz"
     mode: "0644"
@@ -48,22 +55,44 @@
     mode: "0755"
     state: directory
 
+- name: Copy ACME renew-hook script
+  template:
+    src: "renew-hook.sh.j2"
+    dest: "{{ lego_config_dir }}/renew-hook.sh"
+    mode: "0750"
+  vars:
+    lego_cert_dir: "{{ lego_config_dir }}/certificates"
+
 - name: Register lego and create cert
-  command: |
-    {{ lego_install_dir }}/lego --accept-tos
-    {% for dns in certificate_domains %}
-    --domains="{{ dns }}"
-    {%   endfor %}
-    {{ lego_cli_params | join(' ') }}
-    run
+  shell: >
+      {{ lego_install_dir }}/lego --accept-tos
+      --domains="{{ item.cn }}"
+      {% if item.sans is defined and item.sans %}
+      {% for san in item.sans %}--domains="{{ san }}" {% endfor %}
+      {% endif %}
+      {{ lego_cli_params | join(' ') }}
+      run &&
+      {{ lego_config_dir }}/renew-hook.sh '{{ item.cn }}'
   args:
-    creates: "/var/lib/lego/accounts"
+    creates: "{{ lego_certificate_destination.path | default(lego_config_dir + '/certificates') }}/{{ item.cn }}.crt"
   environment: '{ "{{ lego_provider|upper }}_API_KEY": "{{ vault_ionos_token_dns }}" }'
+  loop: "{{ lego_certificate_domains }}"
+  loop_control:
+    label: "{{ item.cn }}"
 
 - name: Copy lego systemd service
   template:
-    src: "{{ item }}.j2"
-    dest: "/etc/systemd/system/{{ item }}"
+    src: "lego.{{ item.1 }}.j2"
+    dest: "/etc/systemd/system/lego_{{ item.0.cn }}.{{ item.1 }}"
     mode: "0644"
-  loop: [lego.service, lego.timer]
-  notify: [Restart lego_service, Restart lego_timer]
+  loop: "{{ lego_certificate_domains | product(['service', 'timer']) | list }}"
+  loop_control:
+    label: "lego_{{ item.0.cn }}.{{ item.1 }}"
+
+- name: Start lego_timer
+  systemd:
+    daemon_reload: true
+    enabled: true
+    name: "lego_{{ item.cn }}.timer"
+    state: started
+  loop: "{{ lego_certificate_domains }}"