role should be usable via include_role, vars should be possible via loop

docs/http-challenge/azbs.md

@@ -74,3 +74,43 @@ rewrite \.well-known/acme-challenge/(.*) https://your-storage-account-name.blob.
               ...
     acme_azbs_tenant_id: "2132184-3534543-54354-3543"
 ```
+
+```yaml
+---
+- name: Lets Encrypt certificates
+  hosts: localhost
+  vars:
+    acme_account_email: "[email protected]"
+    acme_challenge_provider: "azbs"
+    acme_use_live_directory: true
+    acme_convert_cert_to: pfx
+    acme_azbs_resource_group: "my-resource-group"
+    acme_azbs_storage_account_name: "my-storage-account-name"
+    acme_azbs_container_name: "my-container"
+    acme_azbs_subscription_id: "0000-11111-2222-3333-444444"
+    acme_azbs_tenant_id: "2132184-3534543-54354-3543"
+    acme_azbs_client_id: "1234-21231-14152-1231"
+    acme_azbs_secret: !vault |
+              $ANSIBLE_VAULT;1.1;AES256
+              ...
+    az_acme_certificates:
+      example-com:
+        zone: example.com
+        subject_alt_name: [ example.com, domain1.example.com, domain2.example.com ]
+      example2-com:
+        zone: example2.com
+        subject_alt_name: [ example2.com, domain1.example2.com, domain2.example2.com ]
+  tasks:
+    - name: Create and upload Lets Encrypt certificates
+      ansible.builtin.include_role:
+        name: telekom_mms.acme.acme
+      vars:
+        acme_domain:
+          email_address: "[email protected]"
+          certificate_name: "{{ certificate.key }}"
+          zone: "{{ certificate.value.zone }}"
+          subject_alt_name: "{{ certificate.value.subject_alt_name }}"
+      loop: "{{ az_acme_certificates | dict2items }}"
+      loop_control:
+        loop_var: certificate
+```

roles/acme/defaults/main.yml

@@ -1,5 +1,6 @@
 ---
 ### global
+acme_domain: {}
 acme_conf_dir: "{{ lookup('env', 'HOME') }}/letsencrypt"
 acme_cert_dir: "{{ acme_conf_dir }}/certs"
 acme_prerequisites_packagemanager: yum

roles/acme/tasks/preconditions.yml

@@ -6,6 +6,13 @@
       - acme_challenge_provider != ""
     fail_msg: You need to set acme_challenge_provider with a provider. See documentation for a list of possible providers.
 
+- name: Check if a acme_domain is set
+  ansible.builtin.assert:
+    that:
+      - acme_domain is defined
+      - acme_domain != {}
+    fail_msg: You need to set acme_domain. See documentation for a list of possibilities.
+
 - name: Set fact for acme_directory depending on what is set in acme_use_live_directory
   ansible.builtin.set_fact:
     acme_directory: "{{ acme_use_live_directory | ternary(acme_live_directory, acme_staging_directory) }}"

tests/integration/targets/acme_letsencrypt/dns-challenge-include-role.yml

@@ -0,0 +1,38 @@
+---
+- name: Test if include_role is working
+  hosts: localhost
+  tasks:
+    - name: Create and upload Lets Encrypt certificates
+      ansible.builtin.include_role:
+        name: telekom_mms.acme.acme
+        public: true
+      vars:
+        acme_domain:
+          certificate_name: dns-pebble.example.com
+          zone: example.com
+          email_address: [email protected]
+          subject_alt_name:
+            - example.com
+        acme_challenge_provider: pebble
+        acme_use_live_directory: false
+        acme_account_email: [email protected]
+        acme_staging_directory: https://localhost:14000/dir
+        acme_validate_certs: false
+  post_tasks:
+    - name: Validate certs
+      vars:
+        acme_domain:
+          certificate_name: dns-pebble.example.com
+      community.crypto.x509_certificate_info:
+        path: "{{ acme_cert_path }}"
+      register: result
+
+    - name: Print the certificate
+      ansible.builtin.debug:
+        msg: "{{ result }}"
+
+    - name: Check if the certificate is correct
+      ansible.builtin.assert:
+        that:
+          - "'DNS:example.com' in result.subject_alt_name"
+          - "'Pebble Intermediate CA' in result.issuer.commonName"

tests/integration/targets/acme_letsencrypt/dns-challenge-missing-acme-domain.yml

@@ -0,0 +1,12 @@
+---
+- name: Test role if acme_domain is not set
+  hosts: localhost
+  roles:
+    - telekom_mms.acme.acme
+  vars:
+    acme_challenge_provider: pebble
+    acme_use_live_directory: false
+    acme_account_email: [email protected]
+    acme_staging_directory: https://localhost:14000/dir
+    acme_validate_certs: false
+  ignore_errors: true

tests/integration/targets/acme_letsencrypt/runme.sh

@@ -4,3 +4,5 @@ set -eux
 
 ansible-playbook dns-challenge-pebble.yml
 ansible-playbook http-challenge-local.yml
+ansible-playbook dns-challenge-include-role.yml
+ansible-playbook dns-challenge-missing-acme-domain.yml