ansible-taler-exchange

commit 7c9900cafeee7d37b0a9a95feff8301004c7fdfd
parent 7667faa51ca8e9dfe6fa68bbf2cb40a4f7109b17
Author: Florian Dold <dold@taler.net>
Date:   Sat,  1 Aug 2026 14:23:48 +0200

cert: stop reporting a change for the nginx check and unchanged certs

"nginx -t" cannot change anything, and certbot only renews when the cert is
close to expiry; both were counted as changes on every single deploy.

Diffstat:
M
roles/cert/tasks/main.yml
 | 
8
++++++++
M
roles/webserver/tasks/main.yml
 | 
1
+

2 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/roles/cert/tasks/main.yml b/roles/cert/tasks/main.yml
@@ -10,6 +10,7 @@
 - name: Check nginx config
   ansible.builtin.command: nginx -c /etc/nginx/nginx.conf -t
   register: result
+  changed_when: false
   ignore_errors: true
 
 - name: Fail if nginx misconfigured
@@ -47,6 +48,13 @@
 - name: Create or update certs
   command:
     argv: "{{ cmd + domain_args | list }}"
+  register: certbot_result
+  # certbot is run on every deploy but only does something when the cert is
+  # missing or close to expiry; in the common case it just says so and exits 0.
+  # Anything we do not recognize as that no-op counts as a change, so nginx
+  # still gets reloaded if certbot ever words its output differently.
+  changed_when: "'not yet due for renewal' not in certbot_result.stdout"
+  notify: Restart nginx
   vars:
     cmd:
       - certbot
diff --git a/roles/webserver/tasks/main.yml b/roles/webserver/tasks/main.yml
@@ -54,6 +54,7 @@
 - name: Check nginx config
   ansible.builtin.command: nginx -c /etc/nginx/nginx.conf -t
   register: result
+  changed_when: false
   ignore_errors: true
 
 - name: Clear all sites if nginx is misconfigured