From 51a458f26bac7397461000b18688a7b3ef31979b Mon Sep 17 00:00:00 2001
From: Jiri Podivin <jpodivin@redhat.com>
Date: Wed, 1 Jul 2026 16:59:59 +0200
Subject: [PATCH] User certbot role for Log Detective

Signed-off-by: Jiri Podivin <jpodivin@redhat.com>
---
 .../logdetective01.fedorainfracloud.org       |  8 ++++++
 .../logdetective/files/certbot-deploy-hook.sh | 18 +++++++++++++
 roles/logdetective/tasks/main.yml             | 27 ++++++++++++++++++-
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 roles/logdetective/files/certbot-deploy-hook.sh

diff --git a/inventory/host_vars/logdetective01.fedorainfracloud.org b/inventory/host_vars/logdetective01.fedorainfracloud.org
index b025bd3a51..028e6d2d34 100644
--- a/inventory/host_vars/logdetective01.fedorainfracloud.org
+++ b/inventory/host_vars/logdetective01.fedorainfracloud.org
@@ -23,4 +23,12 @@ tcp_ports: [
     22, 80, 443, 8090,
 ]
 
+letsencrypt:
+  certificates:
+    logdetective01.fedorainfracloud.org:
+      challenge_dir: /var/www/html
+      domains:
+        - logdetective01.fedorainfracloud.org
+      mail: copr-devel@lists.fedorahosted.org
+
 zabbix_host: 38.145.32.41
diff --git a/roles/logdetective/files/certbot-deploy-hook.sh b/roles/logdetective/files/certbot-deploy-hook.sh
new file mode 100644
index 0000000000..463c9eef86
--- /dev/null
+++ b/roles/logdetective/files/certbot-deploy-hook.sh
@@ -0,0 +1,18 @@
+#! /bin/sh
+
+copy_certs () {
+    # Copy certificates to location where service will look for them
+    cp /etc/letsencrypt/live/logdetective01.fedorainfracloud.org/fullchain.pem /root/logdetective/server/fullchain.pem 
+    cp /etc/letsencrypt/live/logdetective01.fedorainfracloud.org/privkey.pem /root/logdetective/server/privkey.pem 
+    cp /etc/letsencrypt/live/logdetective01.fedorainfracloud.org/chain.pem /root/logdetective/server/chain.pem 
+    cp /etc/letsencrypt/live/logdetective01.fedorainfracloud.org/cert.pem /root/logdetective/server/cert.pem 
+}
+
+case $1 in --init)
+    copy_certs
+    exit 0 ;;
+esac
+
+copy_certs
+# Restart the service
+systemctl restart logdetective.service
diff --git a/roles/logdetective/tasks/main.yml b/roles/logdetective/tasks/main.yml
index 973d648c1d..fa60ed4eaf 100644
--- a/roles/logdetective/tasks/main.yml
+++ b/roles/logdetective/tasks/main.yml
@@ -14,7 +14,32 @@
       - wget
       - gcc-c++
       - firewalld
-      - certbot
+
+- name: Install certbot deploy hook
+  ansible.builtin.copy:
+    src: certbot-deploy-hook.sh
+    dest: /usr/libexec/auto-certbot-deploy
+    owner: root
+    group: root
+    mode: "0755"
+  tags:
+    - certbot
+
+- name: Install letsencrypt ssl certificates
+  include_role: name=certbot
+  tags:
+    - certbot
+
+- name: Configure certbot deploy hook
+  ansible.builtin.copy:
+    dest: /etc/sysconfig/certbot
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      DEPLOY_HOOK="--deploy-hook /usr/libexec/auto-certbot-deploy"
+  tags:
+    - certbot
 
 - name: Download the cuda repofile
   ansible.builtin.get_url: