Ansible + NS1 + Let's Encrypt

cockfordollie.yml

---

  - name: create let's encrypt account key
    command: "openssl genrsa -out le_account.key 4096"
    args:
      chdir: "{{ key_path }}"
      creates: "{{ key_path }}/le_account.key"
    tags:
      - letsencrypt

  - name: create private key and csr
    command: "openssl req -nodes -newkey rsa:4096 -keyout {{ common_name }}.le.key -out {{ common_name }}.le.csr -subj '/O=Ubersmith/OU=Hosting/CN={{ common_name }}'"
    args:
      chdir: "{{ key_path }}"
      creates: "{{ key_path}}/{{ common_name }}.le.key"
    tags:
      - letsencrypt

  - name: generate let's encrypt request
    letsencrypt:
      account_key: "{{ key_path }}/le_account.key"
      csr: "{{ key_path }}/{{ common_name }}.le.csr"
      dest: "{{ certificate_path }}/{{ common_name }}.le.pem"
      acme_directory: "{{ acme_directory }}"
      challenge: "{{ challenge }}"
    register: le_challenge
    tags:
      - letsencrypt

  - name: create challenge DNS entry
    local_action:
      module: ns1_record
      apiKey: "{{ ns1_key }}"
      name: "{{ le_challenge['challenge_data'][common_name]['dns-01']['resource'] }}.{{ common_name }}"
      zone: "{{ common_name.partition('.') | last }}"
      state: present
      type: TXT
      answers:
        - answer:
            - "{{ le_challenge['challenge_data'][common_name]['dns-01']['resource_value'] }}"
          meta:
            up: True
    become: false
    register: ns1_create
    tags: letsencrypt
    when: challenge == "dns-01"

  - name: let's encrypt wrapup 
    letsencrypt:
      account_key: "{{ key_path }}/le_account.key"
      csr: "{{ key_path }}/{{ common_name }}.le.csr"
      dest: "{{ certificate_path }}/{{ common_name }}.le.pem"
      acme_directory: "{{ acme_directory }}"
      challenge: "{{ challenge }}"
      data: "{{ le_challenge }}"
    tags:
      - letsencrypt

  - name: remove challenge DNS entry
    local_action:
      module: ns1_record
      apiKey: "{{ ns1_key }}"
      name: "{{ le_challenge['challenge_data'][common_name]['dns-01']['resource'] }}.{{ common_name }}"
      zone: "{{ common_name.partition('.') | last }}"
      state: absent
      type: TXT
      answers: []
    become: false
    register: ns1_destroy
    tags: letsencrypt
    when: challenge == "dns-01"