Ansible role to manage letsencrypt certs with acme tool
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
L3D e2ce11d77c
Merge pull request #24 from roles-ansible/action
1 month ago
.github use checkout v3 1 month ago
defaults Create standalone mode 8 months ago
files Improve services restart hook 9 months ago
meta Improve services restart hook 9 months ago
tasks improve and update linting 2 months ago
templates Manage systemd by acmetool 8 months ago
vars improve and update linting 2 months ago
.gitignore repair linting 1 year ago
.yamllint repair linting 1 year ago
LICENCE Add myself to License 1 year ago
README.md typofix 8 months ago

README.md

Ansible Galaxy MIT License

Acmetool LE client

Install and configure the acmetool LE client.

We recomend to use this role together with the do1jlr.nginx ansible role. But this role has a standalone version too.

The do1jlr.nginx role installs a hook to enable nginx https sites and is running the acmetool want $domain command. Or you add the domains you need to the acme_domain_want_list: []. But make sure you your acmetool is able to request the domains. Maybe you want to configure the response-file.yml.j2 for that.

Variables

  • acme_notification_email: (Default: root@example.org): LE account email. The default needs to be changed!

  • acme_reload_services: (Default: []): Services that need a reload by certificat change (There are some services pre-defined in the files/reload file)

  • acme_restart_services: (Default: []): Services that need a restart by certificat change

  • acme_domain_want_list: (Default: []): A list of domain you want to enable. Example:

acme_domain_want_list:
  - name: 'www.example.com'
  • acme_domain_unwant_list: (Default: []): Disable a enabled domain. Same syntax than acme_domain_want_list.

  • submodules_versioncheck: (Default: false): Enable basic versionscheck. (true is recomended)

Files

  • We search the response-file.yml.j2 using the first_found_lookup with the following config:
  files:
    - "response-file.{{ inventory_hostname }}.yml.j2"
    - 'response-file.yml.j2'
  paths:
    - 'templates/acmetool'
    - "templates/{{ inventory_hostname }}"
    - 'files/acmetool'
    - "files/{{ inventory_hostname }}"
    - 'templates'

This file is configuring the acmetool behaviour like certificate type, challange methode, acme notification email and so on. Change the values by providing your own response-file.yml.j2.

  • We search the reload and restart hook using the first_found_lookup with the config defined in vars/main.yml.

  • We deploy the acme-reload and acme-restart configuration based on the acme_reload_services: and acme_restart_services: variables

References

Good to know

  • If you are using debian buster, you are probably interested in a more up to date version of acmetool. Have a look at the do1jlr.acmetool_fix role, that will install a specific version of acmetool on debian based systems.
  • To add a domain manually to acmetool run acmetool want example.com
  • To remove a domain manually from acmetool, acmetool unwant example.com

Testing

We are using the following github actions for testing and releasing to ansible galaxy.

Action Status Marketplace
Ansible Lint check ansible-lint
Galaxy release publish-ansible-role-to-galaxy
Yamllint GitHub Actions yamllint-github-action