Ansible playbook that I use to install Apacht httpd and certbot on Amazon EC2 Linux

web-basic.yml

---

#
# Variables used in this playbook:
#
#   * email_hostmaster -- Contact email address for Let's Encrypt registration
#   * ssl_domains -- List of domains to build into cert, primary domain first
#

##############################################################################
#
# Create localhost self-signed SSL certificate.
# We don't use this anymore, but do it anyway.
#

- name: Install make-snakeoil-cert.sh
  copy:
    src: make-snakeoil-cert.sh
    dest: /etc/pki/tls/make-snakeoil-cert.sh
    mode: 0555

- name: Create snakeoil certificate
  command: /etc/pki/tls/make-snakeoil-cert.sh
  args:
    creates: /etc/pki/tls/certs/localhost.crt


##############################################################################
#
# Setup Apache web server.
#

- name: Install basic web server packages
  yum:
    name: "{{item}}"
    state: present
  with_items:
    - httpd
    - mod_ssl
    - certbot

# httpd must be running before we can run certbot
- name: Start httpd service
  service:
    name: httpd
    state: started
    enabled: yes


##############################################################################
#
# Setup SSL.
#

- name: certbot - register account
  command: certbot register --non-interactive --agree-tos --email "{{email_hostmaster}}"
  args:
    creates: /etc/letsencrypt/accounts

- name: certbot - issue cert
  command: certbot certonly --non-interactive --webroot --webroot-path /var/www/html --domains "{{ssl_domains|join(',')}}"
  args:
    creates: "/etc/letsencrypt/live/{{ssl_domains[0]}}/fullchain.pem"

- name: certbot - create symlink to local cert
  file:
    state: link
    src: "/etc/letsencrypt/live/{{ssl_domains[0]}}"
    path: /etc/letsencrypt/local

- name: httpd - configure SSL certificate file
  lineinfile:
    path: /etc/httpd/conf.d/ssl.conf
    regexp: "^SSLCertificateFile"
    line: "SSLCertificateFile /etc/letsencrypt/local/fullchain.pem"
  notify:
  - reload httpd

- name: httpd - configure SSL key file
  lineinfile:
    path: /etc/httpd/conf.d/ssl.conf
    regexp: "^SSLCertificateKeyFile"
    line: "SSLCertificateKeyFile /etc/letsencrypt/local/privkey.pem"
  notify:
  - reload httpd

- name: schedule certificate renewal
  cron:
    name: "certificate renewal"
    cron_file: zz-local-checks
    user: root
    hour: 0
    minute: 5
    job: "certbot renew --quiet --post-hook /usr/local/sbin/reload-ssl-services"