---
- name: Install and configure Certbot
  hosts: vm01-balancer
  become: true
  gather_facts: true

  vars:
    certbot_install_method: package
    certbot_admin_email: admin@gigacoms.ru
    certbot_auto_renew: true
    certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
    certbot_auto_renew_hour: "5"
    certbot_auto_renew_minute: "{{ 59 |random(seed=inventory_hostname) }}" # random number between 0-59
    certbot_auto_renew_options: --quiet --no-self-upgrade
    certbot_create_reload_services:
      - nginx
    certbot_create_if_missing: true
    certbot_delete_certs: false
    certbot_certs:
      - domains:
          - gigacoms.ru
          - "*.gigacoms.ru"
    certbot_testmode: false
    # Generate key with: tsig-keygen -a HMAC-SHA512 CertbotKey
    certbot_dns_plugin: rfc2136
    certbot_dns_target_server: 91.218.87.251
    certbot_dns_target_server_port: 53
    certbot_dns_tsig_keyname: CertbotKey
    certbot_dns_key_secret: hbxr+SNi3kzzygeArFp/1xgribKLDLZEfRWWh/btH6jauMrcJ0oPyOEuP11d1Oq10HUJnTKnOtb8YlnxrM4HcA==
    certbot_dns_key_algorithm: HMAC-SHA512

  roles:
    - certbot-dns