---
- name: Install and configure Certbot
  hosts: vm02
  become: true
  gather_facts: true

  vars:
    certbot_install_method: package
    certbot_admin_email: mrwho@mrwho.ru
    certbot_auto_renew: true
    certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
    certbot_auto_renew_hour: "5"
    certbot_auto_renew_minute: "{{ 59 |random(seed=inventory_hostname) }}" # random number between 0-59
    certbot_auto_renew_options: --quiet --no-self-upgrade
    certbot_create_reload_services:
      - nginx
    certbot_create_if_missing: true
    certbot_delete_certs: false
    certbot_certs:
      - domains:
          - "*.mrwho.ru"
          - "*.local.mrwho.ru"
    certbot_testmode: false
    # Generate key with: tsig-keygen -a HMAC-SHA512 CertbotKey
    certbot_dns_plugin: rfc2136
    certbot_dns_target_server: 212.60.5.162
    certbot_dns_target_server_port: 53
    certbot_dns_tsig_keyname: CertbotKey
    certbot_dns_key_secret: "as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA=="
    certbot_dns_key_algorithm: HMAC-SHA512

  roles:
    - certbot-dns