#
# Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
#
- name: Install OpenSSL, nginx and software-properties-common
  apt:
    name: [ 'openssl', 'nginx', 'software-properties-common' ]
    state: present
    update_cache: yes

- name: Enable Ubuntu universe repositories
  apt_repository:
    repo: "{{ item }}"
    state: present
  loop:
    - "deb http://archive.ubuntu.com/ubuntu/ focal universe"
    - "deb http://archive.ubuntu.com/ubuntu/ focal-updates universe"
    - "deb http://security.ubuntu.com/ubuntu/ focal-security universe"

- name: Install certbot
  apt:
    name: [ 'certbot', 'python3-certbot-nginx' ]
    state: present
    update_cache: yes

- name: Ensure nginx can read cert files
  file:
    dest: /etc/letsencrypt
    group: www-data
    recurse: yes

- name: Ensure nginx is stopped
  service:
    name: nginx
    state: stopped

- name: Install helper scripts
  copy:
    src: "{{ item }}"
    dest: "/usr/local/bin/{{ item }}"
    owner: root
    group: root
    mode: 0500
  with_items:
    - init_dhparams.sh
    - init_certbot.sh

# File in cron.weekly must NOT have a .sh extension, or crond will not run it
- name: Install certbot_renew.sh weekly cron job
  copy:
    src: "certbot_renew.sh"
    dest: /etc/cron.weekly/certbot_renew
    owner: root
    group: root
    mode: 0755
