---
- name: Comment out certbot renew line in root crontab
  hosts: all
  become: true

  tasks:
    - name: Read current root crontab
      ansible.builtin.command: crontab -l -u root
      register: root_crontab
      changed_when: false
      failed_when: root_crontab.rc not in [0, 1]

    - name: Comment out certbot renew line
      ansible.builtin.copy:
        content: >-
          {{
            root_crontab.stdout_lines
            | map('regex_replace', '^(?!#)(.*certbot renew -q --force-renewal.*)$', '#\1')
            | join('\n')
          }}{{ '\n' }}
        dest: /tmp/root_crontab_modified
        mode: '0600'
      when: root_crontab.rc == 0

    - name: Install modified crontab
      ansible.builtin.command: crontab -u root /tmp/root_crontab_modified
      when: root_crontab.rc == 0

    - name: Remove temporary crontab file
      ansible.builtin.file:
        path: /tmp/root_crontab_modified
        state: absent