---
- name: Informing user of requirement of two main domains 
  when: (certbot.domains | length) < 2 or (certbot.domains | length) > 2
  ansible.builtin.fail:
    msg: Only two domains allowed and required
- name: Informing user of requirement at least one wildcard
  when: (certbot.domains | select("regex", "^\\*\\.") | list | length) == 0
  ansible.builtin.fail:
    msg: At least one of the FQDNs must have a wildcard
# - name: Modifying FQDN list for development
#   when: "certbot.mode == 'dev'"
#   ansible.builtin.set_fact:
#     web_fqdns: "{{ certbot.domains | map('regex_replace', '\\.([^\\.]*)$', '.test') | list }}"
- name: Modifying FQDN list for development
  # when: "certbot.mode == 'prod'"
  ansible.builtin.set_fact:
    web_fqdns: "{{ certbot.domains }}"
- name: Creating domain arguments for certbot
  ansible.builtin.set_fact:
    certbot_domains: "{{ ['-d'] | product(web_fqdns) | map('join', '=') | list }}"
- name: Getting public IP
  community.general.ipify_facts:
    validate_certs: false
    timeout: 20
- name: Starting domain name registration with standalone DNS
  when: "certbot.auth_method == 'dns' and not certbot.containerized"
  ignore_errors: true
  block:
    - name: Opening port 53
      become: true
      ansible.builtin.iptables:
        chain: INPUT
        protocol: tcp
        destination_port: 53
        jump: ACCEPT
        comment: Opening up port 53
    # @NOTE https://github.com/siilike/certbot-dns-standalone
    - name: Exemplifying needed ACME record
      ansible.builtin.set_fact:
        acme_record: |
          {{ inventory_hostname }}    IN A    {{ ipify_public_ip }}
          _acme-challenge.{{ inventory_hostname }}    IN  CNAME    {{ inventory_hostname }}.acme.{{ inventory_hostname }}.
          acme.{{ inventory_hostname }}    IN  NS    ns.acme.{{ inventory_hostname }}.
          ns.acme.{{ inventory_hostname }}    IN  A    {{ ipify_public_ip }}
    - name: Informing user of need to set up ACME record
      ansible.builtin.debug:
        msg: "Please set ACME record in domain name provider:\n {{ acme_record }}"
    - name: Waiting for user to set up ACME records
      ansible.builtin.pause:
    - name: Running certbot to authenticate and acquire domain name certificates
      become: true
      when: "certbot.mode == 'dev'"
      ansible.builtin.command:
        argv:
          - certbot
          - certonly
          - "--staging"
          - "--debug"
          - "--authenticator=dns-standalone"
          - "--email={{ certbot.email }}"
          - "--agree-tos"
          - "--non-interactive"
          - "--dns-standalone-address={{ ipify_public_ip }}"
          # - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
          - "--dns-standalone-port={{ certbot.port }}"
          - "{{ certbot_domains[0] }}"
          - "{{ certbot_domains[1] }}"
    - name: Running certbot to authenticate and acquire domain name certificates
      become: true
      when: "certbot.mode == 'prod'"
      ansible.builtin.command:
        argv:
          - certbot
          - certonly
          - "--authenticator=dns-standalone"
          - "--email={{ certbot.email }}"
          - "--agree-tos"
          - "--non-interactive"
          - "--dns-standalone-address={{ ipify_public_ip }}"
          # - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
          - "--dns-standalone-port={{ certbot.port }}"
          - "{{ certbot_domains[0] }}"
          - "{{ certbot_domains[1] }}"
- name: Starting domain name registration with standalone option
  when: "certbot.auth_method == 'standalone' and not certbot.containerized"
  ignore_errors: true
  block:
    - name: Opening port 80
      become: true
      ansible.builtin.iptables:
        chain: INPUT
        protocol: tcp
        destination_port: 80
        jump: ACCEPT
        comment: Open up port 80
    - name: Acquiring domain certificates
      become: true
      when: "certbot.mode == 'dev'"
      ansible.builtin.command:
        argv:
          - certbot
          - certonly
          - "--staging"
          - "--debug"
          - "--standalone"
          - "--preferred-challenges=http-01"
          - "--email={{ certbot.email }}"
          - "--agree-tos"
          - "--non-interactive"
          - "{{ certbot_domains[0] }}"
          - "{{ certbot_domains[1] }}"
    - name: Acquiring domain certificates
      become: true
      when: "certbot.mode == 'dev'"
      ansible.builtin.command:
        argv:
          - certbot
          - certonly
          - "--standalone"
          - "--email {{ certbot.email }}"
          - "--agree-tos"
          - "--non-interactive"
          - "--preferred-challenges http-01"
          - "{{ certbot_domains[0] }}"
          - "{{ certbot_domains[1] }}"
    - name: Creating needed directory for renewal pre- hooks
      become: true
      ansible.builtin.file:
        path: /etc/letsencrypt/renewal-hooks/pre
        recurse: true
        owner: root
        group: root
        mode: "755"
        state: directory
    - name: Copying renewal pre- hook to renewal pre- hook path
      become: true
      ansible.builtin.copy:
        src: letsencrypt/renewal-hooks/pre/down-dependents.sh
        dest: /etc/letsencrypt/renewal-hooks/pre/
        owner: root
        group: root
        mode: "755"
        force: true
        backup: true
    - name: Creating needed directory for renewal post- hooks
      become: true
      ansible.builtin.file:
        path: /etc/letsencrypt/renewal-hooks/post
        recurse: true
        owner: root
        group: root
        mode: "755"
        state: directory
    - name: Copying renewal post- hook to renewal post- hook path
      become: true
      ansible.builtin.copy:
        src: letsencrypt/renewal-hooks/post/up-dependents.sh
        dest: /etc/letsencrypt/renewal-hooks/post/
        owner: root
        group: root
        mode: "755"
        force: true
        backup: true
- name: Starting domain name registration with webroot option
  when: "certbot.auth_method == 'webroot' and not certbot.containerized"
  block: []