---
- name: 📦 install certbot DNS plugin
  package: # nocheck: dynamic-package
    name: "certbot-dns-{{ CERTBOT_ACME_CHALLENGE_METHOD }}"
    state: present

- name: ✅ Ensure /etc/certbot directory exists
  file:
    path: "{{ CERTBOT_CREDENTIALS_DIR }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: 📦 Install plugin credentials file
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  copy:
    dest: "{{ CERTBOT_CREDENTIALS_FILE }}"
    content: |
      dns_{{ CERTBOT_ACME_CHALLENGE_METHOD }}_api_token = {{ lookup('api', 'cloudflare.api_token') }}
    owner: root
    group: root
    mode: "0600"