---
# Necessary to have this separate file to pass performance tests
- name: 📦 Install certbundle system-wide via pip
include_role:
name: sys-pip-install
vars:
package_name: certbundle
global_install: true
- name: ⚙️ Generate SAN certificate with certbundle
command: >-
certbundle
--domains "{{ CURRENT_PLAY_DOMAINS_ALL | join(',') }}"
--certbot-email "{{ lookup('users', 'platform_administrator').email }}"
--certbot-acme-challenge-method "{{ CERTBOT_ACME_CHALLENGE_METHOD }}"
--chunk-size 100
{% if CERTBOT_ACME_CHALLENGE_METHOD != 'webroot' %}
--certbot-credentials-file "{{ CERTBOT_CREDENTIALS_FILE }}"
--certbot-dns-propagation-seconds "{{ CERTBOT_DNS_PROPAGATION_WAIT_SECONDS }}"
{% else %}
--letsencrypt-webroot-path "{{ LETSENCRYPT_WEBROOT_PATH }}"
{% endif %}
{{ '--mode-test' if MODE_DUMMY | bool else '' }}
register: certbundle_result
changed_when: >
('certificate not yet due for renewal' not in (certbundle_result.stdout | lower | default('')))
and ('certificate not yet due for renewal' not in (certbundle_result.stderr | lower | default('')))
and ('already issued for this exact set of identifiers in the last' not in (certbundle_result.stderr | lower | default('')))
and ('too many certificates' not in (certbundle_result.stderr | lower | default('')))
and ('the service is down for maintenance or had an internal error' not in (certbundle_result.stderr | lower | default('')))
failed_when: >
certbundle_result.rc != 0
and 'too many certificates' not in (certbundle_result.stderr | lower | default(''))
and 'the service is down for maintenance or had an internal error' not in (certbundle_result.stderr | lower | default(''))
- name: ⚠️ Warn if LetsEncrypt was down
when: "'the service is down for maintenance or had an internal error' in (certbundle_result.stderr | lower | default(''))"
debug:
msg: >
WARNING: Let's Encrypt responded with "service down for maintenance / internal error".
Certificate request skipped; please retry later.
- name: ⚠️ Warn if LE rate limit (exact set) was hit
when: "'already issued for this exact set of identifiers in the last' in (certbundle_result.stderr | lower | default(''))"
debug:
msg: >
WARNING: Let's Encrypt rate limit for this exact identifier set was hit.
No changes recorded; retry after the indicated time.
- name: ⚠️ Warn if LE rate limit (generic) was hit
when: "'too many certificates' in (certbundle_result.stderr | lower | default(''))"
debug:
msg: >
WARNING: Let's Encrypt rate limit reached ("too many certificates").
No changes recorded; adjust batching or retry later.
- name: 🔗 Link each domain to the certbundle lineage that covers it
cert_link_domains:
domains: "{{ CURRENT_PLAY_DOMAINS_ALL }}"
cert_base_path: "{{ LETSENCRYPT_LIVE_PATH }}"
- name: ▶️ run the san tasks once
set_fact:
run_once_san_certs: true
