Switch to Nginx's built-in Acme module

Replaces the custom `letsencrypt` role with Nginx's new automated
solution using the `nginx-acme` module. This drastically simplifies
Trellis' SSL setup with Let's Encrypt by delegating most of the
functionality to Nginx.

See https://nginx.org/en/docs/http/ngx_http_acme_module.html

Author: swalkinshaw

.github/workflows/integration.yml

@@ -51,7 +51,7 @@ jobs:
       - run: trellis exec ansible-playbook --version
         working-directory: example.com/trellis
       - name: Provision
-        run: trellis provision --extra-vars "web_user=runner letsencrypt_ca=https://127.0.0.1:8443/acme/acme" production
+        run: trellis provision --extra-vars "web_user=runner acme_server=https://127.0.0.1:8443/acme/acme/directory acme_ssl_verify=off" production
         working-directory: example.com
       - name: Deploy non-https site
         run: trellis deploy --extra-vars "web_user=runner project_git_repo=https://github.com/roots/bedrock.git" production example.com

group_vars/all/helpers.yml

@@ -33,6 +33,7 @@ object_cache_enabled_memcached: "{{ item.value.object_cache.enabled | default(fa
 # Sites using Redis or Memcached object cache
 sites_using_redis: "{{ (wordpress_sites | select_sites('object_cache.enabled', 'true') | select_sites('object_cache.provider', 'eq', 'redis')).keys() | list }}"
 sites_using_memcached: "{{ (wordpress_sites | select_sites('object_cache.enabled', 'true') | select_sites('object_cache.provider', 'eq', 'memcached')).keys() | list }}"
+sites_using_letsencrypt: "{{ (wordpress_sites | select_sites('ssl.enabled', 'true') | select_sites('ssl.provider', 'eq', 'letsencrypt')).keys() | list }}"
 site_hosts_canonical: "{{ item.value.site_hosts | map(attribute='canonical') | list }}"
 site_hosts_redirects: "{{ item.value.site_hosts | selectattr('redirects', 'defined') | sum(attribute='redirects', start=[]) | list }}"
 site_hosts: "{{ site_hosts_canonical | union(site_hosts_redirects) }}"

group_vars/development/main.yml

@@ -1,4 +1,3 @@
-acme_tiny_challenges_directory: "{{ www_root }}/letsencrypt"
 env: development
 mysql_root_password: "{{ vault_mysql_root_password }}" # Define this variable in group_vars/development/vault.yml
 web_user: "{{ ansible_user | default ('web') }}"

roles/common/handlers/main.yml

@@ -1,7 +1,4 @@
 ---
-- name: disable temporary challenge sites
-  import_tasks: disable_challenge_sites.yml
-
 - name: restart memcached
   service:
     name: memcached

roles/common/tasks/disable_challenge_sites.yml

@@ -12,7 +12,7 @@
   loop_control:
     label: "{{ item.key }}"
   when: item.value.site_hosts | rejectattr('canonical', 'defined') | list | count > 0
-  tags: [letsencrypt, wordpress]
+  tags: [wordpress]
 
 - name: Import PHP version specific vars
   include_vars: "{{ lookup('first_found', params) }}"