Change iptables only if really required

tasks/cert_generate.yml

@@ -17,6 +17,7 @@
       protocol: tcp
       jump: ACCEPT
       state: present
+    when: groups.proxyserver is defined and inventory_hostname in groups.proxyserver
 
   - name: Install New Cert via webroot
     shell: certbot certonly --expand --non-interactive --config /etc/letsencrypt/{{ cert.domain }}.ini --cert-name {{ cert.domain }} --webroot-path /var/www/html --webroot
@@ -36,6 +37,7 @@
       protocol: tcp
       jump: ACCEPT
       state: absent
+    when: groups.proxyserver is defined and inventory_hostname in groups.proxyserver
 
   - include_tasks: cert_deploy.yml
 

tasks/renew.yml

@@ -19,6 +19,7 @@
     protocol: tcp
     jump: ACCEPT
     state: present
+  when: groups.proxyserver is defined and inventory_hostname in groups.proxyserver
 
 - name: Renew Existing Certs via webroot
   shell: certbot renew --non-interactive --webroot-path /var/www/html --webroot
@@ -42,6 +43,7 @@
     protocol: tcp
     jump: ACCEPT
     state: absent
+  when: groups.proxyserver is defined and inventory_hostname in groups.proxyserver
 
 - include_tasks: cert_deploy.yml
   with_items: '{{ letsencrypt_certificates|default([]) }}'