From df8a04e6ba9b7d3a2a4826bf44f8c7b49bab9e10 Mon Sep 17 00:00:00 2001
From: Sebastian Fleer <s.fleer@famedly.com>
Date: Thu, 4 Jun 2026 18:28:31 +0200
Subject: [PATCH] chore(lego_openbao) add option to restart containers after
 fetch

---
 roles/lego_openbao/README.md         | 8 ++++++++
 roles/lego_openbao/defaults/main.yml | 3 +++
 roles/lego_openbao/handlers/main.yml | 8 ++++++++
 roles/lego_openbao/tasks/main.yml    | 1 +
 4 files changed, 20 insertions(+)

diff --git a/roles/lego_openbao/README.md b/roles/lego_openbao/README.md
index cdaa22e..9081fb5 100644
--- a/roles/lego_openbao/README.md
+++ b/roles/lego_openbao/README.md
@@ -17,3 +17,11 @@ Set the following variables
 - `lego_openbao_issuer_path` (default: `/v1/pki-int/roles/lego/acme`): Full path to the OpenBao role with ACME support.
 
 The options regarding ACME challenges are the same as documented in the `lego` role, just prefixed with `lego_openbao_` instead of `lego_`.
+
+## Container restart
+
+This role offers a handler to restart Docker containers when a new certificate is issued while running it.
+
+It's possible to configure this behaviour using the variable `lego_openbao_restart_container_names` (default: `[]`).
+
+Actions that should be performed after the systemd service is run can be defined in a script referenced by `lego_openbao_post_renewal_script` (default: ~).
diff --git a/roles/lego_openbao/defaults/main.yml b/roles/lego_openbao/defaults/main.yml
index ec77bdc..c01383d 100644
--- a/roles/lego_openbao/defaults/main.yml
+++ b/roles/lego_openbao/defaults/main.yml
@@ -46,6 +46,9 @@ lego_openbao_tasks:
 lego_openbao_certificate_renewal_days: 30
 lego_openbao_configuration_default_key_type: "ec256"
 
+lego_openbao_restart_container_names: []
+lego_openbao_post_renewal_script: ~
+
 lego_openbao_configuration_defaults:
   command_parameters:
     global:
diff --git a/roles/lego_openbao/handlers/main.yml b/roles/lego_openbao/handlers/main.yml
index 8922fd0..94a44d4 100644
--- a/roles/lego_openbao/handlers/main.yml
+++ b/roles/lego_openbao/handlers/main.yml
@@ -18,3 +18,11 @@
 - name: "Reload systemd"
   ansible.builtin.systemd:
     daemon_reload: true
+
+- name: Restart containers
+  listen: "restart_containers"
+  community.docker.docker_container:
+    name: "{{ item }}"
+    state: "started"
+    restart: true
+  loop: "{{ lego_openbao_restart_container_names | default([], true) }}"
diff --git a/roles/lego_openbao/tasks/main.yml b/roles/lego_openbao/tasks/main.yml
index 01af19b..cc974ac 100644
--- a/roles/lego_openbao/tasks/main.yml
+++ b/roles/lego_openbao/tasks/main.yml
@@ -107,6 +107,7 @@
         lego_openbao_eab_hmac: "{{ lego_openbao_eab_token_data.json.data.key }}"
       register: lego_openbao_run_eab
       changed_when: lego_openbao_run_eab.rc == 0
+      notify: [ "restart_containers" ]
 
 - name: "Check if certificate is nonexistent or differs from wanted state"
   when: