feat(roles/lego): Run hooks with bash -c

ref #13

playbooks/lego_certificate.yml

@@ -10,7 +10,7 @@
       vars:
         _dns_record:
           type: "CNAME"
-          name: "_acme-challenge.{{ _domain }}"
+          name: "_acme-challenge.{{ _domain }}."
           content: "{{ target_tsig_key_name }}.{{ target_acme_zone }}."
       loop: "{{ target_domains }}"
       loop_control:

roles/lego/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 lego_user: "lego"
-lego_version: "4.25.2"
+lego_version: "4.28.1"
 lego_instance: default
 lego_base_path: "/opt/lego"
 lego_cert_user: "acme-{{ lego_instance }}"

roles/lego/files/lego_run.sh

@@ -15,7 +15,7 @@ if [[ -n "${LEGO_HTTP_FALLBACK_PORT:-}" ]]; then
 fi
 
 if [[ -n "${LEGO_PRE_RENEWAL_HOOK:-}" ]]; then
-  $LEGO_PRE_RENEWAL_HOOK
+  /usr/bin/env bash -c "$LEGO_PRE_RENEWAL_HOOK"
 fi
 
 LEGO_COMMAND_ARGS_EXPANDED=$(bash -c "echo $LEGO_COMMAND_ARGS") # This is a bit icky
@@ -31,5 +31,5 @@ find "$LEGO_CERT_STORE_PATH/certificates" -type f | xargs -I{} -n 1 chmod "$LEGO
 find "$LEGO_CERT_STORE_PATH/certificates" -type f | xargs -I{} -n 1 chown "${LEGO_CERT_USER}:${LEGO_CERT_GROUP}" "{}"
 
 if [[ -n "${LEGO_POST_RENEWAL_HOOK:-}" ]]; then
-  $LEGO_POST_RENEWAL_HOOK
+  /usr/bin/env bash -c "$LEGO_POST_RENEWAL_HOOK"
 fi

roles/minio/defaults/main/container.yml

@@ -1,7 +1,7 @@
 ---
 minio_container_name: minio
 minio_container_image_name: "docker.io/minio/minio"
-minio_container_image_tag: "RELEASE.2025-07-23T15-54-02Z"
+minio_container_image_tag: "RELEASE.2025-10-15T17-29-55Z"
 minio_container_image: "{{ minio_container_image_name }}:{{ minio_container_image_tag }}"
 minio_container_networks: []
 minio_container_ports: []

roles/nginx/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-nginx_version: "1.29.1"
+nginx_version: "1.29.3"
 nginx_flavour: alpine
 nginx_base_path: /opt/nginx
 nginx_config_file: "{{ nginx_base_path }}/nginx.conf"