---
- name: Generate Certbot certificates
  ansible.builtin.command: >
    certbot --nginx
    --non-interactive
    --agree-tos
    --redirect
    {{ '--dry-run' if bool_cert_dry_run | default(true) else '' }}
    --email {{ certbot_email | default("admin@" + mydomain) }}
    -d {{ item.key + "." + mydomain if not item.value.internal else item.key + ".internal." + mydomain }}
  loop: "{{ servernames | dict2items }}"
  args:
    creates: "/etc/letsencrypt/live/{{ (item.key ~ '.' ~ mydomain) if not item.value.internal else (item.key ~ '.internal.' ~ mydomain) }}/fullchain.pem"