tpiccioli
/
ansible-roles
forked from ISTI-ansible-roles/ansible-roles
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
ansible-roles/letsencrypt-acmetool-client/defaults/main.yml

45 lines
1.9 KiB
YAML
Raw Normal View History

library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
---
letsencrypt_acme_install: False
library/roles/letsencrypt-acmetool-client: New variable, default, true. If set to false the repository package installation is skipped. Useful to manage unsupported distributions.
2016-05-28 15:04:01 +02:00
# Set to false if a binary installation is needed (unsupported distributions)
letsencrypt_pkg_install: True
library/roles/letsencrypt-acmetool-client: Install libcap2-bin too. Needed to let acmetool bind port 80 when needed.
2016-10-03 22:56:27 +02:00
letsencrypt_acme_pkg_state: latest
letsencrypt_acme_pkgs:
- acmetool
- libcap2-bin
library/roles/letsencrypt-acmetool-client/defaults/main.yml: Fix a typo.
2016-10-03 22:57:43 +02:00
letsencrypt_acme_ppa_repo: 'ppa:hlandau/rhea'
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
letsencrypt_acme_debian_repo: 'deb http://ppa.launchpad.net/hlandau/rhea/ubuntu xenial main'
letsencrypt_acme_debian_repo_key: '9862409EF124EC763B84972FF5AC9651EDB58DFA'
letsencrypt_acme_user: acme
letsencrypt_acme_user_home: /var/lib/acme
library/roles/openldap-server: Support for ssl when letsencrypt is enabled using the letsencrypt-acme-tool role.
2016-04-15 20:33:23 +02:00
letsencrypt_acme_log_dir: /var/log/acme
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
letsencrypt_acme_command: acmetool
letsencrypt_acme_command_opts: '--batch --xlog.syslog --xlog.severity=info'
letsencrypt_acme_config_dir: '{{ letsencrypt_acme_user_home }}/conf'
letsencrypt_acme_certsconf_dir: '{{ letsencrypt_acme_user_home }}/desired'
library/roles/letsencrypt-acmetool-client/defaults/main.yml: Fix the hooks path library/roles/haproxy: Scripts and tasks to add support for the acme letsencrypt tool.
2016-04-14 19:31:02 +02:00
letsencrypt_acme_certs_dir: '{{ letsencrypt_acme_user_home }}/live/{{ ansible_fqdn }}'
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
# The various services maintainers need to put the reconfigure/restart scripts there
letsencrypt_acme_services_scripts_dir: /usr/lib/acme/hooks
# responses parameters
letsencrypt changed the TOS document.
2017-11-17 11:59:42 +01:00
#letsencrypt_tos_url: 'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf'
letsencrypt_tos_url: 'https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf'
library/roles/letsencrypt-acmetool-client: The TOS document URL has changed. Reflect it int the acmetool configuration, otherwise the first configuration fails.
2016-08-04 16:57:32 +02:00
letsencrypt_acme_agree_tos: true
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
letsencrypt_acme_rsa_key_size: 4096
letsencrypt-acme-tool: ocsp must staple option True by default.
2017-10-20 15:55:17 +02:00
letsencrypt_ocsp_must_staple: True
library/roles/letsencrypt-acmetool-client/templates/cert-requirements.j2: rsa key dimension. d4science-infrastructure/group_vars/ldap_liferay_dev/all.yml: openldap on ubuntu/debian is linked to gnuTLS and does not support ecdsa keys.
2016-04-15 20:03:05 +02:00
# rsa|ecdsa
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
letsencrypt_acme_key_type: ecdsa
letsencrypt_acme_ecdsa_curve: nistp256
letsencrypt_acme_email: sysadmin@example.com
letsencrypt-acme-tool: ocsp must staple option True by default.
2017-10-20 15:55:17 +02:00
letsencrypt_specify_key_id: False
letsencrypt_key_id: 'some random string'
library/roles/letsencrypt-acmetool-client/defaults/main.yml: Change the default behaviour to 'listener' so that we can ask for a certificate if the web server is not yet configured.
2017-01-26 18:33:49 +01:00
# We 'listener' or 'proxy'. Use 'listener' if we need a certificate for a non web service or before the web service has been configured.
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
# Need to set cap_net_bind_service=+ep for the acmetool binary so that it is able to bind port 80 in that case.
library/roles/letsencrypt-acmetool-client/defaults/main.yml: Change the default behaviour to 'listener' so that we can ask for a certificate if the web server is not yet configured.
2017-01-26 18:33:49 +01:00
letsencrypt_acme_authenticator: listener
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00
# desired parameters
letsencrypt_acme_domains:
- '{{ ansible_fqdn }}'
library/roles/letsencrypt-acmetool-client/templates/responses.j2: added the staging site to the responses template.
2016-04-17 14:20:44 +02:00
letsencrypt_acme_standalone_port: 4402
library/roles/letsencrypt-acmetool-client: Letsencrypt acmetool client. Better than the original one, can run as an unprivileged user. See https://support.d4science.org/issues/3164
2016-04-14 19:08:33 +02:00