Only update acme.sh if necessary

We install acme.sh into /opt on our servers. Some of our servers rely on
/opt for data intensive activities and we can run out of disk space on
/opt/. When our daily Ansible runs fire and hit servers in this
situation we end up with corrupted acme.sh repos on those servers. Then
acme.sh roles fail.

Avoid this problem by only updating the git repo for acme.sh if it isn't
already up to date on the versions we expect. We can still fill the disk
but this won't affect acme.sh only server operations that rely on /opt
disk space.

This is an alternative to https://review.opendev.org/c/opendev/system-config/+/934247
which will try to force updates to occur regardless of git repo
corruption.

Change-Id: Ib0ad55de833a2c2d9e8cacec0493b8422e486789

playbooks/roles/letsencrypt-acme-sh-install/tasks/main.yaml

@@ -1,3 +1,16 @@
+- name: Check status of acme.sh script
+  stat:
+    path: /opt/acme.sh/acme.sh
+    get_checksum: true
+    checksum_algorithm: sha256
+  register: acme_sh_stat
+
+- name: Install acme.sh if not already up to date
+  when: not acme_sh_stat.stat.exists or acme_sh_stat.stat.checksum != "5c298a2bd5f90635aef8d013b02b25f34027ad0cb2cef2bdca68f3d13b931216"
+  block:
+    # We only want to update the clone and checkout if things are not already
+    # in place or at the expected versions. This avoids unnecessary daily
+    # git operations and makes us more resilient to full disks.
     - name: Install acme.sh client
       git:
         repo: https://github.com/acmesh-official/acme.sh
@@ -24,6 +37,9 @@
 
 - name: Install driver script
   copy:
+    # Because this is a fily copy and not git operations with multiple states
+    # Ansible should successfully determine that the file doesn't need to be
+    # copied after the initial copy unless the file changes.
     src: driver.sh
     dest: /opt/acme.sh/driver.sh
     mode: 0755