role should be usable via include_role, vars should be possible via loop

[michaelamattes]

At the moment the acme role can only use acme_domain in the vars, e.g.

---
- name: Lets Encrypt certificates
  hosts: localhost
  collections:
    - telekom_mms.acme
  roles:
    - telekom_mms.acme.acme
  vars:
    acme_domain:
      email_address: "{{ service_email }}"
      certificate_name: domain
      zone: www.domain.com
      subject_alt_name: ["domain.com"]

Due to the fact that we have more than 100 domains it would be nice if we can loop over the domains.
So the that the role also should be work over ansible.builtin.include_role
So that the code should like, e.g.

---
- name: Lets Encrypt certificates
  hosts: localhost
  tasks:
    - name: Create and upload Lets Encrypt certificates
      ansible.builtin.include_role:
        name: telekom_mms.acme.acme
      vars:
        acme_domain:
          email_address: "{{ service_email }}"
          certificate_name: "{{ certificate.key }}"
          zone: "{{ certificate.value.zone }}"
          subject_alt_name: "{{ certificate.value.subject_alt_name }}"
      loop: "{{ certificates | dict2items }}"
      loop_control:
        loop_var: certificate

[schurzi]

are these checks redundant by the precondition, or are there cases left, where the precondition allows this to happen?

[michaelamattes]

You're right. I changed this with 541861e

[schurzi]

I think this should be move up to be task nr 2

[michaelamattes]

I changed this with 541861e

[schurzi]

I think checking for errors from a role is a bit more complcated and this seems like a good approach:
https://stackoverflow.com/questions/55521078/how-to-deal-with-errors-coming-from-ansible-roles

[michaelamattes]

I tried to add this with 541861e

[avalor1]

I'am not quite sure how the new approach would be looking in a var file. Could you please add an example for this?

[michaelamattes]

I'am not quite sure how the new approach would be looking in a var file. Could you please add an example for this?

I add an example ind the readme with 541861e

[schurzi]

that way this will always succeed. We need to include some tasks at the end, that verify the response of the role.

[schurzi]

suggestion: acme_domain is used as a hash, here the check is looking for an empty array. This is clone enough, that there is no missmatch in Ansible, but I think it would be cleaner to handle it as a {}.

Also applies to the defaults.