Add certbot installation with root cert renew

roles/reverse-proxy/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Confirm Certbot plugin containment level
+  become: true
+  ansible.builtin.command:
+    cmd: snap set certbot trust-plugin-with-root=ok

roles/reverse-proxy/tasks/main.yml

@@ -19,6 +19,53 @@
   ansible.builtin.apt:
     name: nginx # Creates the "nginx" user as well
     state: present
+# TODO: Remove the default configuration here, we'll keep it for now as an example...
+# TODO: Setup Certbot as it's part of the installation...
+# ---------- CERTBOT INSTALLATION ---------- #
+# See the installation instructions here: https://certbot.eff.org/instructions?ws=nginx&os=debianbuster&tab=wildcard
+- name: Install Certbot
+  become: true
+  community.general.snap:
+    name: certbot
+    classic: true
+    state: present
+  notify: Confirm Certbot plugin containment level
+- name: Flush handlers # Makes sure that the handler runs
+  ansible.builtin.meta: flush_handlers
+- name: Install Certbot DNS Cloudflare plugin
+  become: true
+  community.general.snap:
+    name: certbot-dns-cloudflare
+    classic: true
+    state: present
+- name: Set cloudflare variable
+  ansible.builtin.set_fact:
+    cloudflare_credential_dir_path: "/root/.secrets/certbot"
+    cloudflare_credential_filename: cloudflare.ini
+- name: Create Certbot credential directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ cloudflare_credential_dir_path }}"
+    state: directory
+    mode: '0700'
+- name: Place cloudflare credential in certbot user's file
+  become: true
+  ansible.builtin.template:
+    src: cloudflare.ini.j2
+    dest: "{{ cloudflare_credential_dir_path }}/{{ cloudflare_credential_filename }}"
+    mode: '0400'
+- name: Install the certificate script
+  become: true
+  ansible.builtin.template:
+    src: register_certbot_domain.sh.j2
+    dest: /usr/local/bin/register_certbot_domain.sh
+    mode: '0500'
+- name: Create the root certificate for my domain
+  become: true
+  ansible.builtin.command:
+    cmd: register_certbot_domain.sh kleinendorst.info
+    creates: /etc/letsencrypt/live/kleinendorst.info # The certificate directory
+# END ------ CERTBOT INSTALLATION ------ END #
 - name: Start Nginx
   become: true
   ansible.builtin.systemd:

roles/reverse-proxy/templates/cloudflare.ini.j2

@@ -0,0 +1,2 @@
+# Cloudflare API token used by Certbot
+dns_cloudflare_api_token = {{ dns_cloudflare_api_token }}

roles/reverse-proxy/templates/register_certbot_domain.sh.j2

@@ -0,0 +1,6 @@
+#!/bin/bash
+/snap/bin/certbot certonly \
+        --dns-cloudflare \
+        --dns-cloudflare-credentials '{{ cloudflare_credential_dir_path }}/{{ cloudflare_credential_filename }}' \
+        --agree-tos --test-cert -m {{ administration_email }} \
+        -d $1

roles/reverse-proxy/vars/main/defaults.yml

@@ -1,2 +1,3 @@
 ---
 nginx_user: nginx # Created automatically by the apt installation
+certbot_user: certbot

roles/reverse-proxy/vars/main/vault.yml

@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.1;AES256
+35613135623165306639373939396435656431326134336466636666393637333532623036303831
+6534646334633731313838323138303261663536376330640a376538653563353365336634346338
+34663031643265623838396239383164303865346332366361313839386533363530336361373930
+6438313861353563630a343738383365656531313137613361323636653635393232343738633433
+63356634323264623134313565386362663131313963373433306636383661373930323262353663
+64393433393639346166666433396363313465373032343239633939343830303465633564353130
+37333437643064346233633863346632393266633435396433396563653737386233346231303061
+37623138386233303764

roles/snapcraft/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+- name: Install Snapcraft
+  become: true
+  ansible.builtin.apt:
+    name: snapd
+    state: present
+- name: Install Snap Core
+  become: true
+  community.general.snap:
+    name: core
+    state: present

roles/user/tasks/main.yml

@@ -63,12 +63,16 @@
     regexp: '^plugins=\((.*)(?<!zsh-autosuggestions)\)$'
     line: 'plugins=(\1 zsh-autosuggestions)'
     backrefs: true
-- name: Add Starship eval in ~/.zshrc
+# For some reason snap isn't properly configured and its bin directory isn't added to the $PATH variable.
+# This probably has something to do with the hardening rules, instead we'll fix it here.
+- name: Add Starship config and Snapcraft to ~/.zshrc
   become: true
   become_user: "{{ target_user }}"
   ansible.builtin.blockinfile:
     path: ~/.zshrc
     block: |-
+      # Add Snapcraft to $PATH
+      export PATH=$PATH:/snap/bin
 
       # Starship
       eval "$(starship init zsh)"

vault.yml

@@ -1,14 +1,16 @@
 $ANSIBLE_VAULT;1.1;AES256
-34373038613431663961616561383563333464646230303766356139333961633736333665346666
-3461323862343164303961306339613536303261623435360a623839623764306639343766646666
-38376535623131386335383361656430633364646130343939623036636339306531393036663861
-3438366666643962360a613238333032626666633833376530356666373531306439386464393138
-32353438613636303963623132373930383166626264303030376535633762646638653363366231
-62633566653139336538636265666332323632636236633363636563626539613962393766303038
-34316163643663303866376633376361633865646664336163623038383735313835313863363264
-61646336313765353264333034303131316130376538643763306438353031333964353534636561
-62313639623039323135636630356638633932343737626163316434636461316437346230616631
-62386432373465336330386564626561376630313938343039653366346666333138653835363831
-32646336633632616332393430343630636332393565353431386238326238643630633466333561
-35626666636236336132363639663663613237613238366139396332333266346238333032666236
-3033
+30373364386562346336393739366135656330636265663335366166373730383561356633323434
+6363643165643435303563363735313532393130363761620a353535386235333938653739353362
+37623765346234363336343261313637386361383765616534323131313230323832616331643835
+3865653536666533320a616137323464336233393638646166306463616234653434663037393165
+35393337326435653131626230333261666138353931616664646133333061633937313339323261
+62373436363234653837383339613237383530396336383235313537363061653365346234383335
+66346438353535373635663463393366616534346463333365353031323638346562323138333261
+65663134313735313331613032336462383131666364303834343137613061343138366338376566
+64373034616439646265323262323563343132623166336235346439356663633538613639643435
+32313939343134646330653162363538643466656432643737353163653230663665346131363534
+39356164383262353562383633633834326161343737616439313064626432346562346363653666
+32643636353662373665353539313833626364653231323233623961303137383038336136326138
+38363030393430346164653964656665636464666662353130633132313066373338303631343733
+38613230363532306364353164346537353965626161633230343138376639343864316436613039
+643233623535616638333630373031313561