initial ansible code

roles/lego/handlers/main.yml

@@ -0,0 +1,14 @@
+---
+- name: restart lego_timer
+  systemd:
+    daemon_reload: true
+    enabled: true
+    name: lego.timer
+    state: restarted
+
+- name: restart lego_service
+  systemd:
+    daemon_reload: true
+    enabled: true
+    name: lego.service
+    state: restarted

roles/lego/tasks/main.yml

@@ -0,0 +1,67 @@
+---
+- name: Get latest lego version
+  github_release:
+    user: go-acme
+    repo: lego
+    action: latest_release
+    token: "{{ vault_github_token }}"
+  delegate_to: localhost
+  run_once: true
+  register: lego_version
+
+- name: Download lego {{ lego_version.tag }} from GitHub
+  get_url:
+    url: "https://github.com/go-acme/lego/releases/download/\
+          {{ lego_version.tag }}/lego_{{ lego_version.tag }}\
+          _linux_{{ deb_architecture }}.tar.gz"
+    dest: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}.tar.gz"
+  register: _download_archive
+  until: _download_archive is succeeded
+  retries: 3
+  delay: 5
+
+- name: unpack lego binaries
+  unarchive:
+    src: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}.tar.gz"
+    dest: "/tmp"
+    creates: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}"
+    remote_src: true
+    extra_opts:
+      - --one-top-level
+
+- name: Copy lego
+  copy:
+    src: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}/lego"
+    dest: "{{ lego_install_dir }}/lego"
+    remote_src: true
+    mode: 0755
+
+- name: Create lego config directory
+  file:
+    path: "{{ lego_config_dir }}"
+    mode: 0755
+    state: directory
+
+- name: Check lego registration
+  stat:
+    path: "{{ lego_config_dir }}/accounts"
+  register: account_dir
+
+- name: Register lego and create cert
+  command: |
+    {{ lego_install_dir }}/lego --accept-tos
+    {% for dns in certificate_domains %}
+    --domains="{{ dns }}"
+    {%   endfor %}
+    {{ lego_cli_params|join(' ') }}
+    run
+  environment: '{ "{{ lego_provider|upper }}_API_KEY": "{{ vault_ionos_token_dns }}" }'
+  when: not account_dir.stat.exists
+
+- name: Copy lego systemd service
+  template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: 0644
+  loop: [lego.service, lego.timer]
+  notify: [restart lego_service, restart lego_timer]

roles/lego/templates/lego.service.j2

@@ -0,0 +1,19 @@
+## Managed by Ansible ##
+
+[Unit]
+Description=Run lego renew
+After=network-online.target
+
+[Service]
+Type=oneshot
+Environment={{ lego_provider|upper }}_API_KEY={{ vault_ionos_token_dns }}
+ExecStart={{ lego_install_dir }}/lego \
+    {% for dns in certificate_domains %}
+    --domains="{{ dns }}" \
+    {%   endfor %}
+    {{ lego_cli_params|join(' ') }} \
+    renew 
+User=root
+
+[Install]
+WantedBy=multi-user.target

roles/lego/templates/lego.timer.j2

@@ -0,0 +1,12 @@
+## Managed by Ansible ##
+
+[Unit]
+Description=Start lego renew
+
+[Timer]
+Persistent=true
+OnCalendar=Mon 05:00:00
+RandomizedDelaySec=3600
+
+[Install]
+WantedBy=timers.target

roles/lego/vars/main.yml

@@ -0,0 +1,21 @@
+---
+lego_install_dir: "/usr/local/bin"
+lego_config_dir: "/etc/lego"
+lego_provider: "ionos"
+lego_cert_mail: !vault |
+  $ANSIBLE_VAULT;1.2;AES256;dtsv-dev
+  32353064653631636431646333633664363866666439306235303138306461313266343939346463
+  6565636462656666366133653638333433393730656362360a333363623561646436613530623662
+  34623331313964316464653333646134353037333065373063346164623037663235316361646666
+  3466623937663061340a643863633034633665316364313065303166643363653366363063303261
+  34316163616637633837333539626337356563616566346561333439646565373665
+lego_cli_params:
+  - --path={{ lego_config_dir }}
+  - --email={{ lego_cert_mail }}
+  - --dns={{ lego_provider }}
+  - --key-type=ec384
+
+# Certificates
+certificate_domains:
+  - "twirling.de"
+  - "*.twirling.de"