Jeff Geerling
da3ad13935
|
8 years ago | |
---|---|---|
defaults | 8 years ago | |
handlers | 9 years ago | |
meta | 8 years ago | |
tasks | 8 years ago | |
tests | 8 years ago | |
.gitignore | 8 years ago | |
.travis.yml | 8 years ago | |
LICENSE | 8 years ago | |
README.md | 8 years ago |
README.md
Ansible Role: Certbot (for Let's Encrypt)
Installs Certbot (for Let's Encrypt) for RHEL/CentOS or Debian/Ubuntu.
Requirements
Certbot requires Git to be installed. You can install Git using the geerlingguy.git
role.
Role Variables
certbot_repo: https://github.com/certbot/certbot.git
certbot_version: master
certbot_keep_updated: yes
Certbot code repository options. This role clones the agent from the configured repo, then makes the certbot-auto
script executable.
certbot_dir: /opt/certbot
The directory inside which Certbot will be cloned.
certbot_auto_renew: true
certbot_auto_renew_user: "{{ ansible_user }}"
certbot_auto_renew_hour: 3
certbot_auto_renew_minute: 30
By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run certbot-auto renew
via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
Dependencies
None.
Example Playbook
- hosts: servers
vars:
certbot_auto_renew_user: your_username_here
certbot_auto_renew_minute: 20
certbot_auto_renew_hour: 5
roles:
- geerlingguy.certbot
After installation, you can create certificates using the certbot-auto
script, which by default is installed inside the configured certbot_dir
, so by default, /opt/certbot/certbot-auto
. Here are some example commands to configure certificates with Certbot:
# Automatically add certs for all Apache virtualhosts (use with caution!).
/opt/certbot/certbot-auto --apache
# Generate certs, but don't modify Apache configuration (safer).
/opt/certbot/certbot-auto --apache certonly
By default, this role adds a cron job that will renew all installed certificates once per day at the hour and minute of your choosing.
You can test the auto-renewal (without actually renewing the cert) with the command:
/opt/certbot/certbot-auto renew --dry-run
See full documentation and options on the Certbot website.
License
MIT / BSD
Author Information
This role was created in 2016 by Jeff Geerling, author of Ansible for DevOps.