Create certbot_expand flag that expands certificates if domains changes

defaults/main.yml

@@ -6,6 +6,7 @@ certbot_auto_renew_hour: "3"
 certbot_auto_renew_minute: "30"
 certbot_auto_renew_options: "--quiet"
 
+certbot_expand: false
 certbot_testmode: false
 certbot_hsts: false
 
@@ -37,6 +38,7 @@ certbot_create_command: >-
   {{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
   {{ certbot_create_extra_args }}
   -d {{ cert_item.domains | join(',') }}
+  {{ '--expand' if certbot_expand else '' }}
   {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
     if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
   else '' }}

tasks/create-cert-standalone.yml

@@ -40,3 +40,18 @@
 - name: Generate new certificate if one doesn't exist.
   command: "{{ certbot_create_command }}"
   when: not letsencrypt_cert.stat.exists
+
+- name: Register certificate domains (if certbot_expand)
+  shell: "{{ certbot_script }} certificates --cert-name {{ cert_item.domains | first | replace('*.', '') }} | grep Domains | cut -d':' -f2"
+  changed_when: false
+  register: letsencrypt_cert_domains_dirty
+  when: certbot_expand and letsencrypt_cert.stat.exists
+
+- name: Cleanup domain list (if certbot_expand)
+  set_fact:
+    letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
+  when: certbot_expand and letsencrypt_cert.stat.exists
+
+- name: Expand certbot certificate (if certbot_expand)
+  command: "{{ certbot_create_command }}"
+  when: certbot_expand and letsencrypt_cert.stat.exists and letsencrypt_cert_domains != cert_item.domains | map('trim') | select('!=', '') | list | sort

tasks/create-cert-webroot.yml

@@ -12,3 +12,18 @@
 - name: Generate new certificate if one doesn't exist.
   command: "{{ certbot_create_command }}"
   when: not letsencrypt_cert.stat.exists
+
+- name: Register certificate domains (if certbot_expand)
+  shell: "{{ certbot_script }} certificates --cert-name {{ cert_item.domains | first | replace('*.', '') }} | grep Domains | cut -d':' -f2"
+  changed_when: false
+  register: letsencrypt_cert_domains_dirty
+  when: certbot_expand and letsencrypt_cert.stat.exists
+
+- name: Cleanup domain list (if certbot_expand)
+  set_fact:
+    letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
+  when: certbot_expand and letsencrypt_cert.stat.exists
+
+- name: Expand certbot certificate (if certbot_expand)
+  command: "{{ certbot_create_command }}"
+  when: certbot_expand and letsencrypt_cert.stat.exists and letsencrypt_cert_domains != cert_item.domains | map('trim') | select('!=', '') | list | sort