mirror of
https://github.com/geerlingguy/ansible-role-certbot.git
synced 2025-05-22 14:21:40 +02:00
90 lines
3.0 KiB
YAML
90 lines
3.0 KiB
YAML
---
|
|
# Certbot auto-renew cron job configuration (for certificate renewals).
|
|
certbot_auto_renew: true
|
|
certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
|
|
certbot_auto_renew_hour: "3"
|
|
certbot_auto_renew_minute: "30"
|
|
certbot_auto_renew_options: "--quiet"
|
|
|
|
certbot_testmode: false
|
|
certbot_hsts: false
|
|
|
|
|
|
# Parameters used when creating new Certbot certs.
|
|
certbot_create_if_missing: false
|
|
certbot_create_method: standalone
|
|
certbot_create_extra_args: ""
|
|
certbot_admin_email: email@example.com
|
|
certbot_expand: false
|
|
|
|
# Default webroot, overwritten by individual per-cert webroot directories
|
|
certbot_webroot: /var/www/letsencrypt
|
|
|
|
certbot_certs: []
|
|
# - name: example.com
|
|
# email: janedoe@example.com
|
|
# webroot: "/var/www/html/"
|
|
# domains:
|
|
# - example1.com
|
|
# - example2.com
|
|
# - domains:
|
|
# - example3.com
|
|
# - name: example4.com
|
|
# dns_rfc2136_credentials: "local-keyname"
|
|
# domains:
|
|
# - "example4.com"
|
|
# - "example5.com"
|
|
|
|
# certbot_dns_rfc2136_credentials:
|
|
# - name: "local-keyname"
|
|
# server: "192.0.2.1" # ip address only
|
|
# port: 53
|
|
# key_name: "keyname-in-dns-config"
|
|
# secret: "example_rfc2136_secret"
|
|
# algorithm: "HMAC-SHA256"
|
|
|
|
certbot_dns_rfc2136_propagation_seconds: 60
|
|
|
|
certbot_create_command: >-
|
|
{{ certbot_script }} certonly --{{ certbot_create_method }}
|
|
{{ '--hsts' if certbot_hsts else '' }}
|
|
{{ '--test-cert' if certbot_testmode else '' }}
|
|
--noninteractive --agree-tos
|
|
--email {{ cert_item.email | default(certbot_admin_email) }}
|
|
{{ '--expand' if certbot_expand else '' }}
|
|
{{ '--webroot-path ' if certbot_create_method == 'webroot' else '' }}
|
|
{{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
|
|
{{ '--dns-rfc2136-propagation-seconds ' if certbot_create_method == 'dns-rfc2136' else '' }}
|
|
{{ certbot_dns_rfc2136_propagation_seconds if certbot_create_method == 'dns-rfc2136' else '' }}
|
|
{{ '--dns-rfc2136-credentials ' if certbot_create_method == 'dns-rfc2136' else '' }}
|
|
{{ '/etc/letsencrypt/' + cert_item.dns_rfc2136_credentials + '.ini' if certbot_create_method == 'dns-rfc2136' else '' }}
|
|
{{ certbot_create_extra_args }}
|
|
--cert-name {{ cert_item_name }}
|
|
-d {{ cert_item.domains | join(',') }}
|
|
{{ '--expand' if certbot_expand else '' }}
|
|
{{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
|
|
if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
|
|
else '' }}
|
|
{{ '--post-hook /etc/letsencrypt/renewal-hooks/post/start_services'
|
|
if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
|
|
else '' }}
|
|
{{ "--deploy-hook '" ~ cert_item.deploy_hook ~ "'"
|
|
if 'deploy_hook' in cert_item
|
|
else '' }}
|
|
|
|
certbot_create_standalone_stop_services:
|
|
- nginx
|
|
# - apache
|
|
# - varnish
|
|
|
|
# Available options: 'package', 'snap', 'source'.
|
|
certbot_install_method: 'package'
|
|
|
|
# Source install configuration.
|
|
certbot_repo: https://github.com/certbot/certbot.git
|
|
certbot_version: master
|
|
certbot_keep_updated: true
|
|
|
|
# Where to put Certbot when installing from source.
|
|
certbot_dir: /opt/certbot
|
