new major update

roles/init-server/tasks/contingent/pkg/certbot.yml

@@ -18,22 +18,19 @@
 - name: Creating domain arguments for certbot
   ansible.builtin.set_fact:
     certbot_domains: "{{ ['-d'] | product(web_fqdns) | map('join', '=') | list }}"
-- name: Getting public IP
+- name: Getting public IPv4 address
   community.general.ipify_facts:
     validate_certs: false
     timeout: 20
+- name: Getting public IPv6 address
+  when: ipv6_enabled
+  ansible.builtin.shell:
+    cmd: curl -6 icanhazip.com
+  register: ipify_public_ip6
 - name: Starting domain name registration with standalone DNS
   when: "certbot.auth_method == 'dns' and not certbot.containerized"
   ignore_errors: true
   block:
-    - name: Opening port 53
-      become: true
-      ansible.builtin.iptables:
-        chain: INPUT
-        protocol: tcp
-        destination_port: 53
-        jump: ACCEPT
-        comment: Opening up port 53
     # @NOTE https://github.com/siilike/certbot-dns-standalone
     - name: Exemplifying needed ACME record
       ansible.builtin.set_fact:
@@ -42,6 +39,14 @@
           _acme-challenge.{{ fqdn | default(inventory_hostname) }}    IN  CNAME    {{ fqdn | default(inventory_hostname) }}.acme.{{ fqdn | default(inventory_hostname) }}.
           acme.{{ fqdn | default(inventory_hostname) }}    IN  NS    ns.acme.{{ fqdn | default(inventory_hostname) }}.
           ns.acme.{{ fqdn | default(inventory_hostname) }}    IN  A    {{ ipify_public_ip }}
+    - name: Exemplifying needed ACME record
+      when: ipv6_enabled
+      ansible.builtin.set_fact:
+        acme_record: |
+          {{ fqdn | default(inventory_hostname) }}    IN A    {{ ipify_public_ip6.stdout }}
+          _acme-challenge.{{ fqdn | default(inventory_hostname) }}    IN  CNAME    {{ fqdn | default(inventory_hostname) }}.acme.{{ fqdn | default(inventory_hostname) }}.
+          acme.{{ fqdn | default(inventory_hostname) }}    IN  NS    ns.acme.{{ fqdn | default(inventory_hostname) }}.
+          ns.acme.{{ fqdn | default(inventory_hostname) }}    IN  A    {{ ipify_public_ip6.stdout }}
     - name: Informing user of need to set up ACME record
       ansible.builtin.debug:
         msg: "Please set ACME record in domain name provider:\n {{ acme_record }}"
@@ -49,7 +54,7 @@
       ansible.builtin.pause:
     - name: Running certbot to authenticate and acquire domain name certificates
       become: true
-      when: "certbot.mode == 'dev'"
+      when: "certbot.mode == 'dev' and not ipv6_enabled"
       ansible.builtin.command:
         argv:
           - certbot
@@ -61,13 +66,30 @@
           - "--agree-tos"
           - "--non-interactive"
           - "--dns-standalone-address={{ ipify_public_ip }}"
-          # - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
           - "--dns-standalone-port={{ certbot.port }}"
           - "{{ certbot_domains[0] }}"
           - "{{ certbot_domains[1] }}"
     - name: Running certbot to authenticate and acquire domain name certificates
       become: true
-      when: "certbot.mode == 'prod'"
+      when: "certbot.mode == 'dev' and ipv6_enabled"
+      ansible.builtin.command:
+        argv:
+          - certbot
+          - certonly
+          - "--staging"
+          - "--debug"
+          - "--authenticator=dns-standalone"
+          - "--email={{ certbot.email }}"
+          - "--agree-tos"
+          - "--non-interactive"
+          - "--dns-standalone-address={{ ipify_public_ip }}"
+          - "--dns-standalone-ipv6-address={{ ipify_public_ip6.stdout }}"
+          - "--dns-standalone-port={{ certbot.port }}"
+          - "{{ certbot_domains[0] }}"
+          - "{{ certbot_domains[1] }}"
+    - name: Running certbot to authenticate and acquire domain name certificates
+      become: true
+      when: "certbot.mode == 'prod' and not ipv6_enabled"
       ansible.builtin.command:
         argv:
           - certbot
@@ -77,7 +99,22 @@
           - "--agree-tos"
           - "--non-interactive"
           - "--dns-standalone-address={{ ipify_public_ip }}"
-          # - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
+          - "--dns-standalone-port={{ certbot.port }}"
+          - "{{ certbot_domains[0] }}"
+          - "{{ certbot_domains[1] }}"
+    - name: Running certbot to authenticate and acquire domain name certificates
+      become: true
+      when: "certbot.mode == 'prod' and ipv6_enabled"
+      ansible.builtin.command:
+        argv:
+          - certbot
+          - certonly
+          - "--authenticator=dns-standalone"
+          - "--email={{ certbot.email }}"
+          - "--agree-tos"
+          - "--non-interactive"
+          - "--dns-standalone-address={{ ipify_public_ip }}"
+          - "--dns-standalone-ipv6-address={{ ipify_public_ip6.stdout }}"
           - "--dns-standalone-port={{ certbot.port }}"
           - "{{ certbot_domains[0] }}"
           - "{{ certbot_domains[1] }}"
@@ -85,14 +122,6 @@
   when: "certbot.auth_method == 'standalone' and not certbot.containerized"
   ignore_errors: true
   block:
-    - name: Opening port 80
-      become: true
-      ansible.builtin.iptables:
-        chain: INPUT
-        protocol: tcp
-        destination_port: 80
-        jump: ACCEPT
-        comment: Open up port 80
     - name: Acquiring domain certificates
       become: true
       when: "certbot.mode == 'dev'"