system-config/playbooks/roles/letsencrypt-install-txt-record/tasks/main.yaml

- name: Make key list
  set_fact:
    acme_txt_keys: []

- name: Build key list
  set_fact:
    acme_txt_keys: '{{ acme_txt_keys }} + {{ hostvars[item]["acme_txt_required"] | default([]) }}'
  with_inventory_hostnames:
    - letsencrypt:!disabled

# NOTE(ianw): Most of the time, we won't have anything to actually do
# as we don't have new keys or renewals due.
- name: Deploy TXT records
  block:
    - name: Deploy new zone.db
      template:
        src: zone.db.j2
        dest: /var/lib/bind/zones/acme.opendev.org/zone.db

    - name: Ensure domain is valid
      shell: named-checkzone acme.opendev.org /var/lib/bind/zones/acme.opendev.org/zone.db

    - name: Reload domain
      shell: rndc reload acme.opendev.org

    - name: Pause to allow nameserver propagation
      pause:
        minutes: 1

  when: acme_txt_keys | length > 0