Ansible role to manage letsencrypt certs with acme tool
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
L3D 25907677aa
Merge pull request #26 from roles-ansible/lint
5 months ago
.github Bump robertdebock/galaxy-action from 1.2.0 to 1.2.1 10 months ago
defaults Create standalone mode 2 years ago
files Improve services restart hook 2 years ago
meta update ansible-linting 5 months ago
tasks update ansible-linting 5 months ago
templates Manage systemd by acmetool 2 years ago
vars update ansible-linting 5 months ago
.gitignore repair linting 2 years ago
.yamllint repair linting 2 years ago
LICENCE Add myself to License 2 years ago typofix 2 years ago

Ansible Galaxy MIT License

Acmetool LE client

Install and configure the acmetool LE client.

We recomend to use this role together with the do1jlr.nginx ansible role. But this role has a standalone version too.

The do1jlr.nginx role installs a hook to enable nginx https sites and is running the acmetool want $domain command. Or you add the domains you need to the acme_domain_want_list: []. But make sure you your acmetool is able to request the domains. Maybe you want to configure the response-file.yml.j2 for that.


  • acme_notification_email: (Default: LE account email. The default needs to be changed!

  • acme_reload_services: (Default: []): Services that need a reload by certificat change (There are some services pre-defined in the files/reload file)

  • acme_restart_services: (Default: []): Services that need a restart by certificat change

  • acme_domain_want_list: (Default: []): A list of domain you want to enable. Example:

  - name: ''
  • acme_domain_unwant_list: (Default: []): Disable a enabled domain. Same syntax than acme_domain_want_list.

  • submodules_versioncheck: (Default: false): Enable basic versionscheck. (true is recomended)


  • We search the response-file.yml.j2 using the first_found_lookup with the following config:
    - "response-file.{{ inventory_hostname }}.yml.j2"
    - 'response-file.yml.j2'
    - 'templates/acmetool'
    - "templates/{{ inventory_hostname }}"
    - 'files/acmetool'
    - "files/{{ inventory_hostname }}"
    - 'templates'

This file is configuring the acmetool behaviour like certificate type, challange methode, acme notification email and so on. Change the values by providing your own response-file.yml.j2.

  • We search the reload and restart hook using the first_found_lookup with the config defined in vars/main.yml.

  • We deploy the acme-reload and acme-restart configuration based on the acme_reload_services: and acme_restart_services: variables


Good to know

  • If you are using debian buster, you are probably interested in a more up to date version of acmetool. Have a look at the do1jlr.acmetool_fix role, that will install a specific version of acmetool on debian based systems.
  • To add a domain manually to acmetool run acmetool want
  • To remove a domain manually from acmetool, acmetool unwant


We are using the following github actions for testing and releasing to ansible galaxy.

Action Status Marketplace
Ansible Lint check ansible-lint
Galaxy release publish-ansible-role-to-galaxy
Yamllint GitHub Actions yamllint-github-action