r/lego-nginx: Configure LEGO for nginx

The *lego-nginx* role automates obtaining certificates for *nginx* via
ACME using `lego`.  It generates a shell script with the appropriate
arguments for `lego run`, runs it once to obtain a certificate
initially, then schedules it to run periodically via a systemd timer
unit. Using `lego`'s "hook" capability, the script signals the `nginx`
server process to reload.  This uses `doas` for now, but could be
adapted easily to use `sudo`, if the need ever arises.

roles/lego/tasks/main.yml

@@ -0,0 +1,66 @@
+- name: load os-specific values
+  include_vars: '{{ item }}'
+  with_first_found:
+  - '{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml'
+  - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml'
+  - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml'
+  - '{{ ansible_distribution }}.yml'
+  - '{{ ansible_os_family }}.yml'
+  - defaults.yml
+  tags:
+  - always
+
+- name: ensure lego is installed
+  package:
+    name:
+    - acl  # required for `become_user: lego`
+    - '{{ lego_package }}'
+    state: present
+  tags:
+  - install
+
+- name: ensure lego group exists
+  group:
+    name: lego
+    system: true
+  tags:
+  - user
+  - group
+- name: ensure lego user exists
+  user:
+    name: lego
+    group: lego
+    system: true
+    home: /var/lib/lego
+    createhome: true
+    shell: /bin/false
+  tags:
+  - user
+
+- name: ensure lego-renew systemd units are installed
+  copy:
+    src: '{{ item }}'
+    dest: /etc/systemd/system/
+    owner: root
+    group: root
+    mode: u=rw,go=r
+  loop:
+  - lego-renew.service
+  - lego-renew.timer
+  notify:
+  - reload systemd
+  tags:
+  - systemd
+
+- name: ensure lego-renew systemd timer is enabled
+  systemd:
+    name: lego-renew.timer
+    enabled: true
+  tags:
+  - service
+- name: ensure lego-renew systemd timer is running
+  systemd:
+    name: lego-renew.timer
+    state: started
+  tags:
+  - service