certificates.yml

---
- name: Generate private keys
  shell: openssl genrsa 4096 > {{ letsencrypt_keys_dir }}/{{ item.key }}.key
  args:
    creates: "{{ letsencrypt_keys_dir }}/{{ item.key }}.key"
  when: site_uses_letsencrypt
  loop: "{{ wordpress_sites | dict2items }}"
  loop_control:
    label: "{{ item.key }}"

- name: Ensure correct permissions on private keys
  file:
    path: "{{ letsencrypt_keys_dir }}/{{ item.key }}.key"
    mode: '0600'
  when: site_uses_letsencrypt
  loop: "{{ wordpress_sites | dict2items }}"
  loop_control:
    label: "{{ item.key }}"

- name: Generate Lets Encrypt certificate IDs
  shell: |
    set -eo pipefail
    echo "{{ [site_hosts | join(' '), letsencrypt_ca, acme_tiny_commit] | join('\n') }}" |
    cat {{ letsencrypt_account_key }} {{ letsencrypt_keys_dir }}/{{ item.key }}.key - |
    md5sum | cut -c -7
  args:
    executable: /bin/bash
  register: generate_cert_ids
  changed_when: false
  when: site_uses_letsencrypt
  loop: "{{ wordpress_sites | dict2items }}"
  loop_control:
    label: "{{ item.key }}"
  tags: [wordpress, wordpress-setup, wordpress-setup-nginx, nginx-includes]

- name: Generate CSRs
  shell: "openssl req -new -sha256 -key '{{ letsencrypt_keys_dir }}/{{ item.key }}.key' -subj '/' -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf '[SAN]\nsubjectAltName=DNS:{{ site_hosts | join(',DNS:') }}')) > {{ acme_tiny_data_directory }}/csrs/{{ item.key }}-{{ letsencrypt_cert_ids[item.key] }}.csr"
  args:
    executable: /bin/bash
    creates: "{{ acme_tiny_data_directory }}/csrs/{{ item.key }}-{{ letsencrypt_cert_ids[item.key] }}.csr"
  when: site_uses_letsencrypt
  loop: "{{ wordpress_sites | dict2items }}"
  loop_control:
    label: "{{ item.key }}"

- name: Generate certificate renewal script
  template:
    src: renew-certs.py
    dest: "{{ acme_tiny_data_directory }}/renew-certs.py"
    mode: '0700'
  tags: [wordpress, wordpress-setup, wordpress-setup-nginx, nginx-includes]

- name: Generate the certificates
  command: ./renew-certs.py
  args:
    chdir: "{{ acme_tiny_data_directory }}"
  register: generate_certs
  changed_when: generate_certs.stdout is defined and 'Created' in generate_certs.stdout
  notify: reload nginx
  tags: [wordpress, wordpress-setup, wordpress-setup-nginx, nginx-includes]