chore(lego_openbao) add option to restart containers after fetch

roles/lego_openbao/README.md

@@ -17,3 +17,11 @@ Set the following variables
 - `lego_openbao_issuer_path` (default: `/v1/pki-int/roles/lego/acme`): Full path to the OpenBao role with ACME support.
 
 The options regarding ACME challenges are the same as documented in the `lego` role, just prefixed with `lego_openbao_` instead of `lego_`.
+
+## Container restart
+
+This role offers a handler to restart Docker containers when a new certificate is issued while running it.
+
+It's possible to configure this behaviour using the variable `lego_openbao_restart_container_names` (default: `[]`).
+
+Actions that should be performed after the systemd service is run can be defined in a script referenced by `lego_openbao_post_renewal_script` (default: ~).

roles/lego_openbao/defaults/main.yml

@@ -46,6 +46,9 @@ lego_openbao_tasks:
 lego_openbao_certificate_renewal_days: 30
 lego_openbao_configuration_default_key_type: "ec256"
 
+lego_openbao_restart_container_names: []
+lego_openbao_post_renewal_script: ~
+
 lego_openbao_configuration_defaults:
   command_parameters:
     global:

roles/lego_openbao/handlers/main.yml

@@ -18,3 +18,11 @@
 - name: "Reload systemd"
   ansible.builtin.systemd:
     daemon_reload: true
+
+- name: Restart containers
+  listen: "restart_containers"
+  community.docker.docker_container:
+    name: "{{ item }}"
+    state: "started"
+    restart: true
+  loop: "{{ lego_openbao_restart_container_names | default([], true) }}"

roles/lego_openbao/tasks/main.yml

@@ -107,6 +107,7 @@
         lego_openbao_eab_hmac: "{{ lego_openbao_eab_token_data.json.data.key }}"
       register: lego_openbao_run_eab
       changed_when: lego_openbao_run_eab.rc == 0
+      notify: [ "restart_containers" ]
 
 - name: "Check if certificate is nonexistent or differs from wanted state"
   when: