ansible-roles/mongodb-org/tasks/mongodb-letsencrypt-acmetool.yml

---
- block:
  - name: Create the acme hooks directory if it does not yet exist
    file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root

  - name: Install a script that fix the letsencrypt certificate for mongodb and then reload the service
    template: src=mongodb-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/mongodb owner=root group=root mode=4555

  - name: Create the mongodb certificate directory
    file: dest={{ mongodb_ssl_cert_dir }} state=directory owner=root group=mongodb mode=0750

  - name: Get the Letsencrypt CA file if there is no local copy yet
    get_url: url={{ mongodb_ssl_letsencrypt_ca_url }} dest={{ mongodb_ssl_cert_dir }}/{{ mongodb_ssl_letsencrypt_ca_filename }}
    register: build_mongo_ca_file

  - name: Add the Root CA certificate to the mongodb CA file
    command: cat {{ mongodb_ssl_root_CA_file }} >> {{ mongodb_ssl_cert_dir }}/{{ mongodb_ssl_letsencrypt_ca_filename }}
    when: build_mongo_ca_file is changed

  - name: Verify if the mongodb pem file exists
    stat: path={{ mongodb_ssl_certkey_file }}
    register: mongodb_pem

  - name: Copy the certificate and its key where the mongo server expects it
    command: "{{ letsencrypt_acme_services_scripts_dir }}/mongodb"
    when: not mongodb_pem.stat.exists

  when:
    - mongodb_ssl_letsencrypt_managed
    - letsencrypt_acme_install
  tags: [ 'mongodb', 'letsencrypt', 'mongodb_letsencrypt' ]