All-in-one certbot wrapper for CentOS 7—make executable and copy to /usr/local/bin; alter plugins on line 29 to taste

certbot

#!/usr/bin/env bash

# stop immediately if the script fails
set -Eeuo pipefail

# use chronic if installed
export LANG=C
CHRONIC=$(command -v chronic)

# install required packages
${CHRONIC} yum install -y epel-release
${CHRONIC} yum install -y centos-release-scl
${CHRONIC} yum install -y rh-python38-python-pip
${CHRONIC} yum install -y moreutils

# activate the Python 3.8 runtime
export MANPATH=${MANPATH:+:$MANPATH}
source /opt/rh/rh-python38/enable

# create the virtual environemnt
${CHRONIC} pip install -U virtualenv
[ ! -d /opt/certbot/bin/activate ] && ${CHRONIC} virtualenv /opt/certbot

# activate the virtual environment
source /opt/certbot/bin/activate

# install/update certbot
${CHRONIC} pip install -U pip
${CHRONIC} pip install -U certbot-plugin-gandi

# install the cronjob
if ! fgrep "certbot renew" /etc/crontab &> /dev/null; then
    tee -a /etc/crontab > /dev/null <<'EOF'
@daily root sleep $[RANDOM\%90]m; chronic certbot renew
EOF
fi

# run certbot
exec certbot "$@"