ansible-roles/roles/mysql_server/templates/dehydrated_hook.j2

#!/bin/sh

{% if mysql_letsencrypt_cert is defined %}

if [ $1 == "{{ mysql_letsencrypt_cert | split | first }}" ]; then
  cp /var/lib/dehydrated/certificates/certs/{{ mysql_letsencrypt_cert | split | first }}/fullchain.pem /etc/my.ssl/server.crt
  cp /var/lib/dehydrated/certificates/certs/{{ mysql_letsencrypt_cert | split | first }}/privkey.pem /etc/my.ssl/server.key
  chown root:mysql /etc/my.ssl/server.key
  chown root:root /etc/my.ssl/server.crt
  chmod 640 /etc/my.ssl/server.key
  chmod 644 /etc/my.ssl/server.crt
  mysql -e 'FLUSH SSL;' || systemctl restart mysql
fi

{% else %}

# No Let's Encrypt cert configured, nothing to do
exit 0

{% endif %}