Add lego-installing role.

playbook-provision.yml

@@ -55,6 +55,7 @@
     - 'base'
     - 'certbot'
     - 'imagemagick'
+    - 'lego'
     - 'livepatch'
     - 'monitoring'
     - 'webserver'

roles/lego/defaults/main.yml

@@ -0,0 +1,21 @@
+# This file was written by Damien Dart, <[email protected]>. This is
+# free and unencumbered software released into the public domain. For
+# more information, please refer to the accompanying "UNLICENCE" file.
+
+---
+# A string containing a checksum used to verify the integrity of the
+# lego binary archive "lego_4.18.0_linux_amd64.tar.gz". See
+# <https://github.com/go-acme/lego/releases> for archives and checksums.
+lego__lego_archive_checksum: 'sha256:6f42e9ac93cd604951c0cf94a7c4a26ac98251741523ce67eea86ad72c77e6e5'
+
+# A string containing the version of lego to install.
+lego__lego_version: '4.18.0'
+
+
+# The following variables will have host-specific and/or sensitive
+# values and must be defined elsewhere (in an inventory, playbook, at
+# runtime, etc).
+
+# A string containing the directory where downloaded files are stored to
+# prevent unnecessary downloading when tasks are rerun.
+lego__download_cache_directory: '{{ undef() }}'

roles/lego/meta/main.yml

@@ -0,0 +1,7 @@
+# This file was written by Damien Dart, <[email protected]>. This is
+# free and unencumbered software released into the public domain. For
+# more information, please refer to the accompanying "UNLICENCE" file.
+
+---
+dependencies:
+  - role: 'webserver'

roles/lego/tasks/main.yml

@@ -0,0 +1,32 @@
+# This file was written by Damien Dart, <[email protected]>. This is
+# free and unencumbered software released into the public domain. For
+# more information, please refer to the accompanying "UNLICENCE" file.
+
+---
+- name: 'Ensure download cache directory exists'
+  ansible.builtin.file:
+    path: '{{ lego__download_cache_directory }}'
+    group: 'root'
+    mode: '0777'
+    owner: 'root'
+    state: 'directory'
+
+- name: 'Ensure the lego binary archive is downloaded'
+  ansible.builtin.get_url:
+    checksum: '{{ lego__lego_archive_checksum }}'
+    dest: '{{ lego__download_cache_directory }}/lego_v{{ lego__lego_version }}_linux_amd64.tar.gz'
+    group: 'root'
+    mode: 0755
+    owner: 'root'
+    url: 'https://github.com/go-acme/lego/releases/download/v{{ lego__lego_version }}/lego_v{{ lego__lego_version }}_linux_amd64.tar.gz'
+
+- name: 'Ensure the lego binary is installed'
+  ansible.builtin.unarchive:
+    dest: '/usr/local/bin'
+    include:
+      - 'lego'
+    group: 'root'
+    mode: 0755
+    owner: 'root'
+    remote_src: true
+    src: '{{ lego__download_cache_directory }}/lego_v{{ lego__lego_version }}_linux_amd64.tar.gz'