mirror of
https://github.com/roles-ansible/ansible_role_acmetool.git
synced 2024-08-16 12:29:49 +02:00
71 lines
3.3 KiB
Markdown
71 lines
3.3 KiB
Markdown
[](https://galaxy.ansible.com/ui/standalone/roles/l3d/acmetool/) [](https://github.com/roles-ansible/ansible_role_acmetool/blob/main/LICENCE)
|
|
|
|
Acmetool LE client
|
|
==================
|
|
|
|
Install and configure the `acmetool` LE client.
|
|
|
|
We recomend to use this role together with the [do1jlr.nginx](https://github.com/do1jlr/ansible_role_nginx.git) ansible role. But this role has a standalone version too.
|
|
|
|
The ``do1jlr.nginx`` role installs a hook to enable nginx https sites and is running the ``acmetool want $domain`` command. Or you add the domains you need to the ``acme_domain_want_list: []``. But make sure you your acmetool is able to request the domains. Maybe you want to configure the ``response-file.yml.j2`` for that.
|
|
|
|
|
|
Variables
|
|
-----------
|
|
|
|
* ``acme_notification_email:`` (Default: ``root@example.org``):
|
|
LE account email. The default needs to be changed!
|
|
|
|
* ``acme_reload_services:`` (Default: ``[]``):
|
|
Services that need a reload by certificat change
|
|
*(There are some services pre-defined in the [files/reload](files/reload) file)*
|
|
|
|
* ``acme_restart_services:`` (Default: ``[]``):
|
|
Services that need a restart by certificat change
|
|
|
|
* ``acme_domain_want_list:`` (Default: ``[]``):
|
|
A list of domain you want to enable. Example:
|
|
```yml
|
|
acme_domain_want_list:
|
|
- name: 'www.example.com'
|
|
```
|
|
|
|
* ``acme_domain_unwant_list:`` (Default: ``[]``):
|
|
Disable a enabled domain. Same syntax than ``acme_domain_want_list``.
|
|
|
|
* ``submodules_versioncheck:`` (Default: ``false``):
|
|
Enable basic versionscheck. *(``true`` is recomended)*
|
|
|
|
|
|
Files
|
|
-------
|
|
* We search the ``response-file.yml.j2`` using the [first_found_lookup](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/first_found_lookup.html) with the following config:
|
|
```yaml
|
|
files:
|
|
- "response-file.{{ inventory_hostname }}.yml.j2"
|
|
- 'response-file.yml.j2'
|
|
paths:
|
|
- 'templates/acmetool'
|
|
- "templates/{{ inventory_hostname }}"
|
|
- 'files/acmetool'
|
|
- "files/{{ inventory_hostname }}"
|
|
- 'templates'
|
|
```
|
|
This file is configuring the acmetool behaviour like certificate type, challange methode, acme notification email and so on. Change the values by providing your own ``response-file.yml.j2``.
|
|
|
|
* We search the ``reload`` and ``restart`` hook using the [first_found_lookup](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/first_found_lookup.html) with the config defined in ``vars/main.yml``.
|
|
|
|
* We deploy the ``acme-reload`` and ``acme-restart`` configuration based on the ``acme_reload_services:`` and ``acme_restart_services:`` variables
|
|
|
|
References
|
|
------------
|
|
|
|
* [acmetool](https://github.com/hlandau/acmetool)
|
|
* [acmetool user's guide](https://hlandau.github.io/acmetool/userguide)
|
|
|
|
Good to know
|
|
--------------
|
|
+ If you are using debian buster, you are probably interested in a more up to date version of acmetool. Have a look at the [do1jlr.acmetool_fix](https://galaxy.ansible.com/do1jlr/acmetool_fix) role, that will install a specific version of acmetool on debian based systems.
|
|
+ To add a domain manually to acmetool run ``acmetool want example.com``
|
|
+ To remove a domain manually from acmetool, ``acmetool unwant example.com``
|
|
|