| commit | author | age | ||
| 6ea5c9 | 1 | Role Name |
| WK | 2 | ========= |
| 3 | ||
| 4 | host-lets-encrypt-certs | |
| 5 | ||
| 6 | Requirements | |
| 7 | ------------ | |
| 8 | ||
| 9 | Request Let's Encrypt Certificates for a host. Supports Wildcard certificates of AWS Credentials are provided. | |
| 10 | ||
| 11 | If static certificates are requested this role needs to run on the host for which certificates are being requested. If wildcard certificates are not involved then the role *must* be run on the host that is requesting the certificates. And that host *must* respond to the DNS address the certificates are requested for. There can not be a web server running on the host that will serve the domain. Otherwise the request will fail. | |
| 12 | ||
| 13 | If Wildcard certificates are involved the role can run on any (AWS) host because validation of the domain will happen via AWS Access Credentials to the Route53 entry for which wildcard certificates are being requested. | |
| 14 | ||
| 15 | ||
| 16 | Role Variables | |
| 17 | -------------- | |
| 18 | ||
| 76f57e | 19 | |Variable Name|Required|Default Value|Description |
| WK | 20 | |------------ |----------- |-----------|----------- |
| 21 | |*acme_domain*|Yes|"" |Domain name for which to request a certificate. _Limitation_: Curently only *one* domain name can be requested. | |
| 22 | |*acme_wildcard_domain*|No|""|Wildcard domain name for which to request a certificate | |
| 23 | |*acme_aws_access_key*|No |"" |AWS Access Key for Route53 (Only for Wildcard Domains) | |
| 24 | |*acme_aws_secret_access_key*|No| "" |AWS Secret Access Key for Route53 (Only for Wildcard Domains) | |
| 25 | |*acme_additional_args*|No |"" |Additional arguments for the Acme script | |
| 26 | |*acme_remote_dir*|Yes| "/root"| The directoroy on the remote host in which to install acme.sh | |
| 9b7d25 | 27 | |*acme_install_dir*|Yes| "/root/certificates"| The directory on the remote host in which to install the requested certificates into |
| 76f57e | 28 | |*acme_cache_cert_file*|Yes| "/tmp/ssl.cert"| Local Cache File for Certificate |
| WK | 29 | |*acme_cache_key_file*|Yes| "/tmp/ssl.key"|Local Cache File for Key |
| 30 | |*acme_cache_ca_file*|Yes| "/tmp/ssl_ca.cer"|Local Cache File for CA Certificate | |
| 3a536f | 31 | |*acme_cache_fullchain_file*|Yes| "/tmp/fullchain.cer"|Local Cache File for the Fullchain Certificate |
| WK | 32 | |*acme_cache_archive_file*|Yes| "/tmp/acme.tar.gz"| Local (to the host ansible is running on) cache of certificates. Prevents re-requesting certificates for later runs of the playbook when the domains haven't changed. acme.tar.gz will contain the entire .acme.sh directory so that it can be restored for future runs on new machines with the same domain names. |
| 76f57e | 33 | |*acme_production*|Yes|False|Use the Production Let's Encrypt Server. Leave to False for testing runs to prevent issues with the Let's Encrypt rate limits |
| WK | 34 | |*acme_renew_automatically*|Yes|False|Install a cron job to automatically renew Certificates. Checks once a day. |
| 35 | |*acme_force_issue*|Yes|False|Force the creation of new certificates even if there are certificates already on the host or certificates in the local cache | |
| 6ea5c9 | 36 | |
| WK | 37 | |
| 38 | Dependencies | |
| 39 | ------------ | |
| 40 | ||
| 41 | None | |
| 42 | ||
| 43 | Example Playbook | |
| 44 | ---------------- | |
| 45 | ||
| 46 | Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: | |
| 47 | ||
| 76f57e | 48 | ``` |
| 6ea5c9 | 49 | - name: Request Let's Encrypt Static Certificates |
| WK | 50 | hosts: server |
| 51 | gather_facts: False | |
| 52 | tasks: | |
| 53 | - name: Call Role | |
| 54 | include_role: | |
| 55 | name: ../../roles/host-lets-encrypt-certs | |
| 56 | vars: | |
| 57 | - acme_domain: "master.example.opentlc.com" | |
| 58 | - acme_production: False | |
| 59 | - acme_remote_dir: "/root" | |
| 3a536f | 60 | - acme_cache_cert_file: "/tmp/server.cert" |
| WK | 61 | - acme_cache_key_file: "/tmp/server.key" |
| 62 | - acme_cache_ca_file: "/tmp/server_ca.cer" | |
| 63 | - acme_cache_fullchain_file: "/tmp/fullchain.cer" | |
| 64 | - acme_cache_archive_file: "/tmp/acme.tar.gz" | |
| 6ea5c9 | 65 | - acme_renew_automatically: False |
| WK | 66 | - acme_force_issue: False |
| 67 | ||
| 68 | - name: Request Let's Encrypt Wildcard Certificates | |
| 69 | hosts: quay | |
| 70 | gather_facts: False | |
| 71 | tasks: | |
| 72 | - name: Call Role | |
| 73 | include_role: | |
| 74 | name: ../ansible/roles/host-lets-encrypt-certs | |
| 75 | vars: | |
| 76 | - acme_wildcard_domain: "*.apps.example.opentlc.com" | |
| 77 | - acme_aws_access_key: "<AWS ACCESS KEY>" | |
| 78 | - acme_aws_secret_access_key: "<AWS_SECRET_ACCESS_KEY>" | |
| 79 | - acme_production: False | |
| 80 | - acme_remote_dir: "/root" | |
| 3a536f | 81 | - acme_cache_cert_file: "/tmp/server.cert" |
| WK | 82 | - acme_cache_key_file: "/tmp/server.key" |
| 83 | - acme_cache_ca_file: "/tmp/server_ca.cer" | |
| 84 | - acme_cache_fullchain_file: "/tmp/fullchain.cer" | |
| 85 | - acme_cache_archive_file: "/tmp/acme.tar.gz" | |
| 6ea5c9 | 86 | - acme_renew_automatically: False |
| WK | 87 | - acme_force_issue: False |
| 88 | ||
| 89 | - name: Request Both Let's Encrypt Static and Wildcard Certificates | |
| 90 | hosts: quay | |
| 91 | gather_facts: False | |
| 92 | tasks: | |
| 93 | - name: Call Role | |
| 94 | include_role: | |
| 95 | name: ../ansible/roles/host-lets-encrypt-certs | |
| 96 | vars: | |
| 97 | - acme_domain: "master.example.opentlc.com" | |
| 98 | - acme_wildcard_domain: "*.apps.example.opentlc.com" | |
| 99 | - acme_aws_access_key: "<AWS ACCESS KEY>" | |
| 100 | - acme_aws_secret_access_key: "<AWS_SECRET_ACCESS_KEY>" | |
| 101 | - acme_production: False | |
| 102 | - acme_remote_dir: "/root" | |
| 3a536f | 103 | - acme_cache_cert_file: "/tmp/server.cert" |
| WK | 104 | - acme_cache_key_file: "/tmp/server.key" |
| 105 | - acme_cache_ca_file: "/tmp/server_ca.cer" | |
| 106 | - acme_cache_fullchain_file: "/tmp/fullchain.cer" | |
| 107 | - acme_cache_archive_file: "/tmp/acme.tar.gz" | |
| 6ea5c9 | 108 | - acme_renew_automatically: False |
| WK | 109 | - acme_force_issue: False |
| 76f57e | 110 | ``` |
