- name: make sure the `openssl` package is installed
  ansible.builtin.apt:
    name: openssl
    state: present
  become: true

- name: make sure the `certbot` package is installed
  ansible.builtin.apt:
    name: certbot={{ certbot__version_spec }}*
    state: present
    allow_change_held_packages: true
    update_cache: true
  become: true

- name: apt-mark hold `certbot`
  ansible.builtin.dpkg_selections:
    name: certbot
    selection: hold
  become: true