playbook.yml

---
- hosts: letsencrypt
  become: true
  gather_facts: no

  pre_tasks:
    - raw: apt-get install -y python-simplejson

  tasks:
    - name: Upgrade system
      apt: upgrade=dist update_cache=yes

    - name: Install nginx
      apt: name=nginx state=latest

    - name: install letsencrypt
      apt: name=letsencrypt state=latest

    - name: create letsencrypt directory
      file: name=/var/www/letsencrypt state=directory

    - name: Remove default nginx config
      file: name=/etc/nginx/sites-enabled/default state=absent

    - name: Install system nginx config
      template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/nginx.conf

    - name: Install nginx site for letsencrypt requests
      template:
        src: templates/nginx-http.j2
        dest: /etc/nginx/sites-enabled/http

    - name: Reload nginx to activate letsencrypt site
      service: name=nginx state=restarted

    - name: Create letsencrypt certificate
      shell: letsencrypt certonly -n --webroot -w /var/www/letsencrypt -m {{ letsencrypt_email }} --agree-tos -d {{ domain_name }}
      args:
        creates: /etc/letsencrypt/live/{{ domain_name }}

    - name: Generate dhparams
      shell: openssl dhparam -out /etc/nginx/dhparams.pem 2048
      args:
        creates: /etc/nginx/dhparams.pem

    - name: Install nginx site for specified site
      template:
        src: templates/nginx-le.j2
        dest: /etc/nginx/sites-enabled/le

    - name: Reload nginx to activate specified site
      service: name=nginx state=restarted

    - name: Add letsencrypt cronjob for cert renewal
      cron:
        name: letsencrypt_renewal
        special_time: weekly
        job: letsencrypt --renew certonly -n --webroot -w /var/www/letsencrypt -m {{ letsencrypt_email }} --agree-tos -d {{ domain_name }} && service nginx reload