---
- name: Remove certbot installed via package manager
  become: true
  ansible.builtin.dnf:
    name: certbot
    state: absent

- name: Install pip
  become: true
  ansible.builtin.dnf:
    name: python3-pip
    state: present

- name: Install certbot and DNS plugin via pip
  become: true
  ansible.builtin.pip:
    name:
      - certbot
      - certbot-dns-cloudns
    state: present

- name: Ensure CloudDNS credentials directory exists
  become: true
  ansible.builtin.file:
    path: /etc/letsencrypt
    state: directory
    mode: '0700'

- name: Create CloudDNS credentials file
  become: true
  ansible.builtin.copy:
    content: |
      dns_cloudns_auth_id={{ nginx_proxy_cloudns_auth_id }}
      dns_cloudns_auth_password={{ nginx_proxy_cloudns_auth_password }}
    dest: "{{ nginx_proxy_certbot_credential_file }}"
    mode: "{{ nginx_proxy_certbot_credential_mode }}"
    owner: root
    group: root

- name: Obtain TLS certificate via DNS-01 challenge
  become: true
  ansible.builtin.command: >-
    certbot certonly
    --authenticator dns-cloudns
    --dns-cloudns-credentials {{ nginx_proxy_certbot_credential_file }}
    --dns-cloudns-nameserver {{ nginx_proxy_cloudns_nameserver }}
    -d {{ __nginx_proxy_certbot_domains | join(' -d ') }}
    --non-interactive
    --agree-tos
    -m {{ nginx_proxy_certbot_email }}
  args:
    creates: "/etc/letsencrypt/live/{{ __nginx_proxy_certbot_domains[0] }}/fullchain.pem"

- name: Create certbot renewal cron job
  become: true
  ansible.builtin.cron:
    name: "certbot renewal"
    minute: "{{ nginx_proxy_certbot_cron_minute }}"
    hour: "{{ nginx_proxy_certbot_cron_hour }}"
    job: "certbot renew --deploy-hook 'systemctl reload nginx'"