add cert renewal logic

ansible/roles/lego/tasks/generate_cert.yaml

@@ -1,3 +1,8 @@
+- name: Check if SSL cert already exists for domain
+  stat:
+    path: "/root/.lego/certificates/{{ inventory_hostname | default(cert_domain) }}.crt"
+  register: existing_cert_check
+
 - name: Generate initial cert (http)
   command:
     cmd: /usr/local/bin/lego -a --email="{{ letsencrypt_email }}" --domains="{{ inventory_hostname | default(cert_domain) }}" --key-type {{ cert_key_type | default('rsa4096') }} --http run
@@ -15,3 +20,13 @@
     LINODE_PROPAGATION_TIMEOUT: 600
     LINODE_TOKEN: "{{ linode_dns_token }}"
   when: lego_method == 'dns'
+
+- name: Renew cert (dns)
+  command:
+    cmd: /usr/local/bin/lego -a --email="{{ letsencrypt_email }}" --dns linode --domains="{{ inventory_hostname | default(cert_domain) }}" --key-type {{ cert_key_type | default('rsa4096') }} renew
+    chdir: /root
+  environment:
+    LINODE_POLLING_INTERVAL: 120
+    LINODE_PROPAGATION_TIMEOUT: 600
+    LINODE_TOKEN: "{{ linode_dns_token }}"
+  when: lego_method == 'dns' and existing_cert_check.stat.exists