mirror of
https://github.com/geerlingguy/ansible-role-certbot.git
synced 2025-04-20 09:11:43 +02:00
86 lines
2.8 KiB
YAML
86 lines
2.8 KiB
YAML
---
|
|
# Certbot auto-renew cron job configuration (for certificate renewals).
|
|
certbot_auto_renew: true
|
|
certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
|
|
certbot_auto_renew_hour: "3"
|
|
certbot_auto_renew_minute: "30"
|
|
certbot_auto_renew_options: "--quiet --no-self-upgrade"
|
|
|
|
# Enable to use staging server instead of production (useful for testing)
|
|
certbot_use_staging_server: false
|
|
# Enable delete certificates prior generating
|
|
certbot_delete_certificate: false
|
|
|
|
# Parameters used when creating new Certbot certs.
|
|
certbot_create_if_missing: false
|
|
certbot_create_method: standalone
|
|
certbot_admin_email: email@example.com
|
|
certbot_certs: []
|
|
# - email: janedoe@example.com
|
|
# domains:
|
|
# - example1.com
|
|
# - example2.com
|
|
# - domains:
|
|
# - example3.com
|
|
certbot_create_command: >-
|
|
{{ certbot_script }} certonly --standalone --noninteractive --agree-tos
|
|
{{ '--test-cert'
|
|
if certbot_use_staging_server
|
|
else '' }}
|
|
--email {{ cert_item.email | default(certbot_admin_email) }}
|
|
-d {{ cert_item.domains | join(',') }}
|
|
{{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
|
|
if certbot_create_standalone_stop_services
|
|
else '' }}
|
|
{{ '--post-hook /etc/letsencrypt/renewal-hooks/post/start_services'
|
|
if certbot_create_standalone_stop_services
|
|
else '' }}
|
|
|
|
# Parameters DNS Plugins (used when certbot_create_method = dns)
|
|
certbot_dns_plugin: rfc2136
|
|
# certbot_dns_credentials_custom_file: <file-path> # use when plugin is != rfc2136
|
|
# certbot_dns_target_server: 127.0.0.1
|
|
# certbot_dns_target_server_port: 53
|
|
# certbot_dns_tsig_keyname: "certbot."
|
|
# certbot_dns_key_secret: "azertyAZERTY123456"
|
|
# certbot_dns_key_algorithm: "HMAC-MD5"
|
|
|
|
certbot_dns_create_command: >-
|
|
{{ certbot_script }} certonly --noninteractive --agree-tos
|
|
{{ '--test-cert'
|
|
if certbot_use_staging_server
|
|
else '' }}
|
|
--dns-{{ certbot_dns_plugin }} --dns-{{ certbot_dns_plugin }}-credentials {{ certbot_dns_credentials_file }}
|
|
--email {{ cert_item.email | default(certbot_admin_email) }}
|
|
-d {{ cert_item.domains | join(',') }}
|
|
{{ '--deploy-hook /etc/letsencrypt/renewal-hooks/deploy/deploy_hook.sh'
|
|
if certbot_create_dns_deploy_hook_services
|
|
else '' }}
|
|
|
|
certbot_create_dns_deploy_hook_services:
|
|
- haproxy
|
|
#- nginx
|
|
#- apache
|
|
|
|
certbot_create_standalone_stop_services:
|
|
- nginx
|
|
# - apache
|
|
# - varnish
|
|
|
|
# [root@dnstest-default-9qvkw-test-3 ~]# certbot delete --cert-name certbotdnstest.staging.prodepa.pa.gov.br -n
|
|
|
|
certbot_delete_command: >-
|
|
{{ certbot_script }} delete --noninteractive
|
|
--cert-name {{ cert_item.domains | first | replace('*.', '') }}
|
|
|
|
# Available options: 'package', 'snap', 'source'.
|
|
certbot_install_method: 'package'
|
|
|
|
# Source install configuration.
|
|
certbot_repo: https://github.com/certbot/certbot.git
|
|
certbot_version: master
|
|
certbot_keep_updated: true
|
|
|
|
# Where to put Certbot when installing from source.
|
|
certbot_dir: /opt/certbot
|
