source: darkpeak-services/roles/apache2/tasks/configure-apache-site.yml @ 04d89726

- name: Create site directories
  file:
    state: directory
    path:  "{{ item.path }}"
    group: "{{ item.group }}"
    owner: "{{ item.owner }}"
    mode:  "{{ item.mode }}"
  with_items:
    - { path: '/var/log/apache2/{{ service_name }}', group: 'adm', owner: 'www-data', mode: '0750' }
    - { path: '{{ web_root }}', group: 'www-data', owner: 'root', mode: '0751' }
  notify:
    - reload apache2

- name: Configure a TLS certificate for this site
  include: ../../tls/tasks/configure-tls-cert.yml

# The default vhost *must* be the first lexigraphically, so for the default service
# we add a filename prefix of '0-' to ensure that is the case

- name: Install vhost
  template:
    src: ../../apache2/templates/apache.vhost.conf.j2
    dest: "/etc/apache2/sites-available/{{ '0-default' if service_name == 'default' else service_name }}.conf"
    owner: root
    group: root
    mode: 0644
  register: vhost_config

- name: Enable vhost
  file:
    src: "/etc/apache2/sites-available/{{ '0-default' if service_name == 'default' else service_name }}.conf"
    dest: "/etc/apache2/sites-enabled/{{ '0-default' if service_name == 'default' else service_name }}.conf"
    state: link

# This file is supplied by the calling role, and included in the apache configuration
# by the above vhost file

- name: Install custom site config
  template:
    src: apache.incl.conf.j2
    dest: "/etc/apache2/includes/{{ service_name }}.incl.conf"
    owner: root
    group: root
    mode: 0644
  notify:
    - reload apache2

# We want to reload apache config _now_ instead of waiting for the notify
# task to run so we can request certificates using certbot and have the
# appropriate apache config in place for verification
- name: Reload apache now if vhost config changed
  service:
    name: apache2
    state: reloaded
  when: vhost_config is changed

- name: Check to see if a valid letsencrypt live directory is present
  stat:
    path: "/etc/letsencrypt/live/{{ domain }}/README"
  register: letsencrypt_live
  when:
    - vhost_config is changed
    - domain != ""

- name: Remove letsencrypt live directory if it's not valid
  file:
    path: "/etc/letsencrypt/live/{{ domain }}"
    state: absent
  when:
    - not letsencrypt_live.stat.exists
    - development_mode != true
    - domain != ""

- name: Request letsencrypt certificate via certbot
  command: "certbot certonly --non-interactive -m certificate@darkpeak.org --agree-tos --webroot -w /usr/share/certbot -d \"{{ domain }}\""
  when:
    - development_mode != true
    - domain != ""