---
- name: Comment out certbot renew line in root crontab
  hosts: all
  become: true

  tasks:
    - name: Check if certbot line exists and is uncommented
      ansible.builtin.shell: |
        crontab -l -u root 2>/dev/null | grep -q '^[^#].*certbot renew -q --force-renewal'
      register: certbot_line
      changed_when: false
      failed_when: false

    - name: Comment out certbot renew line
      ansible.builtin.shell: |
        crontab -l -u root 2>/dev/null | \
        sed 's|^\([^#].*certbot renew -q --force-renewal.*\)|#\1|' | \
        crontab -u root -
      when: certbot_line.rc == 0