Can't use webroot as challenge type

[panki27]

Hi,

I'm not able to use the example:

    - name: "Trigger invocation of the foundata.acmesh.run role"
      ansible.builtin.include_role:
        name: "foundata.acmesh.run"
      vars:
        run_acmesh_autoupgrade: true
        run_acmesh_cfg_accountemail: "hostmaster@example.org"
        run_acmesh_certs:
          - domains:
              - name: "example.org"
                challenge:  # parameters depend on type
                  type: "webroot"
                  webroot: "/var/www/example.org"
            install:
              ca_file: "/etc/pki/tls/certs/example.org/ca.cer"
              cert_file: "/etc/pki/tls/certs/example.org/cert.cer"
              fullcain_file: "/etc/pki/tls/certs/example.org/fullchain.cer"
              key_file: "/etc/pki/tls/certs/example.org/cert.key"
              reloadcmd: "/bin/systemctl reload apache2.service"
            server: "letsencrypt_test"

Running this in a playbook against a server errors out:

[ERROR]: Task failed: Action failed: Validation of arguments failed:
run_acmesh_certs.domains.challenge.webroot. Supported parameters include: challenge_alias, dns_provider, domain_alias, httpport, tlsport, type.
Origin: <unknown>

The documentation appears to be wrong: it states that the domain_alias parameter should be used to set the webroot?

ansible-collection-acmesh/roles/run/README.md

Line 516 in 30cb275

###### `run_acmesh_certs['domains']['challenge']['domain_alias']`<a id="variable-run_acmesh_certs-sub-domains-sub-challenge-sub-domain_alias"></a>

Replacing webroot: with domain_alias: makes it pass the parameter check, but crashes the actual acme.sh call because the wrong (and missing) parameters are supplied.

[andreashaerter]

Thanks for reporting this and for the detailed description 👍

You’re right... and this is not acceptable from my maintenance POV that a basic feature like webroot challenge path is currently broken in the role. Unfortunately, this code path is missing automated Molecule tests, which is likely why this slipped through. Most users of the role (including our internal usage) rely on DNS-based challenges for certificate issuance, so the webroot variant hasn’t received as much real-world coverage recently.

Note for the team: I’ll take a closer look at this and work on a fix. Going forward, I also need to think about how to properly test the webroot challenge automatically in the lab. One idea would be something similar to the DNS challenge tests, possibly using additional Molecule environment variables that point to a reverse proxy into our test infrastructure so the HTTP challenge can be validated.