From 7af7bdbd4bc7d2c9994c491ed70febc14a9e32e1 Mon Sep 17 00:00:00 2001
From: Chantal Rosmuller <chantal.rosmuller@surf.nl>
Date: Fri, 17 Jul 2026 09:52:32 +0200
Subject: [PATCH] force renewal certs

---
 roles/haproxy/tasks/acme.yml           | 18 +++++++++---------
 roles/haproxy/tasks/get_acme_certs.yml | 20 ++++++++++----------
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/roles/haproxy/tasks/acme.yml b/roles/haproxy/tasks/acme.yml
index ed6ffed89..3aeb3b20e 100644
--- a/roles/haproxy/tasks/acme.yml
+++ b/roles/haproxy/tasks/acme.yml
@@ -1,5 +1,5 @@
 ---
-- name: Create acme user
+- name: "Create acme user"
   ansible.builtin.user:
     name: "acme"
     state: "present"
@@ -8,19 +8,19 @@
       - "haproxy"
     append: true
 
-- name: Install acl package so ansible can run as an unprivilegd user
+- name: "Install acl package so ansible can run as an unprivilegd user"
   ansible.builtin.package:
     name: "acl"
     state: "present"
 
-- name: Clone the acme.sh repo
+- name: "Clone the acme.sh repo"
   ansible.builtin.git:
     repo: "https://github.com/acmesh-official/acme.sh.git"
     dest: "/opt/acmesh/"
     version: "3.1.0"
     update: true
 
-- name: Install the acme.sh script
+- name: "Install the acme.sh script"
   ansible.builtin.shell:
     cmd: |
       sh /opt/acmesh/acme.sh --install --accountemail "{{ admin_email }}"
@@ -29,7 +29,7 @@
   become: true
   become_user: "acme"
 
-- name: Set email address in acme config
+- name: "Set email address in acme config"
   ansible.builtin.lineinfile:
     path: "/home/acme/.acme.sh/account.conf"
     line: "ACCOUNT_EMAIL='{{ admin_email }}'"
@@ -38,11 +38,11 @@
     group: "acme"
     mode: "0600"
 
-- name: Find CA account dir
+- name: "Find CA account dir"
   ansible.builtin.set_fact:
     haproxy_acme_ca_dir: "/home/acme/.acme.sh/ca/{{ haproxy_acme_server | replace('https://', '') }}"
 
-- name: Create the acme account
+- name: "Create the acme account"
   ansible.builtin.command:
     cmd: |
       /home/acme/.acme.sh/acme.sh
@@ -55,12 +55,12 @@
   become: true
   become_user: "acme"
 
-- name: Remove default cronjob for renewal
+- name: "Remove default cronjob for renewal"
   ansible.builtin.file:
     path: "/var/spool/cron/crontabs/acme"
     state: "absent"
 
-- name: Install cronjob for renewal
+- name: "Install cronjob for renewal"
   ansible.builtin.copy:
     dest: "/etc/cron.d/acme-renew"
     owner: "root"
diff --git a/roles/haproxy/tasks/get_acme_certs.yml b/roles/haproxy/tasks/get_acme_certs.yml
index 18e87bc49..aa87c83c4 100644
--- a/roles/haproxy/tasks/get_acme_certs.yml
+++ b/roles/haproxy/tasks/get_acme_certs.yml
@@ -1,5 +1,5 @@
 ---
-- name: Create list of domains to request certificates for
+- name: "Create list of domains to request certificates for"
   ansible.builtin.set_fact:
     haproxy_ssl_hosts: >
       {{
@@ -12,10 +12,10 @@
         | unique | sort
       }}
 
-- name: Check existence of acme CNAME records
+- name: "Check existence of acme CNAME records"
   ansible.builtin.command:
     cmd: "dig +short -t CNAME '_acme-challenge.{{ item }}'"
-  register: haproxy_acme_cname
+  register: "haproxy_acme_cname"
   failed_when: "haproxy_acme_cname.stdout == ''"
   changed_when: false
   loop: "{{ haproxy_ssl_hosts }}"
@@ -24,10 +24,10 @@
   check_mode: false  # this is safe run run, even in check mode
   run_once: true
 
-- name: Update certificates on one host at a time
+- name: "Update certificates on one host at a time"
   throttle: 1
   block:
-    - name: Issue the certificates using acme
+    - name: "Issue the certificates using acme"
       ansible.builtin.command:
         cmd: |
           /home/acme/.acme.sh/acme.sh
@@ -40,7 +40,7 @@
             --dnssleep 3
             --server "{{ haproxy_acme_server }}"
             --domain "{{ item }}"
-            {{ acme_account.changed | ternary('--force', '') }}
+            {{ acme_account.changed  OR (acme_force_renewal is defined AND acme_force_renewal) | ternary('--force', '') }}
       environment:
         ACMEDNS_BASE_URL: "{{ haproxy_acmedns.baseurl }}"
         ACMEDNS_USERNAME: "{{ haproxy_acmedns.username }}"
@@ -59,7 +59,7 @@
     # 1. Cold-deploy the certificates to haproxy's certs directory
     # 2. Make sure haproxy is started, and hot-deploy the certificates to haproxy though the socket API
 
-    - name: Cold-deploy the certificates to haproxy  # noqa: no-handler
+    - name: "Cold-deploy the certificates to haproxy"  # noqa: no-handler
       ansible.builtin.command:
         cmd: |
           /home/acme/.acme.sh/acme.sh
@@ -75,20 +75,20 @@
       become_user: "acme"
       become: true
 
-    - name: Start and enable haproxy
+    - name: "Start and enable haproxy"
       ansible.builtin.service:
         name: "haproxy"
         state: "started"
         enabled: true
 
-    - name: Wait for port 443 to become open  # noqa: no-handler
+    - name: "Wait for port 443 to become open"  # noqa: no-handler
       ansible.builtin.wait_for:
         port: 443
         delay: 5
         host: "{{ haproxy_sni_ip.ipv4 }}"
       when: "acme_issue.changed"
 
-    - name: Hot-deploy the certificates to haproxy  # noqa: no-handler
+    - name: "Hot-deploy the certificates to haproxy"  # noqa: no-handler
       ansible.builtin.command:
         cmd: |
           /home/acme/.acme.sh/acme.sh