| A role to install certbot and create SSL certificates via letsencrypt.org
- installs certbot
- creates certificates for given domains
- will stop/start daemons
This role does not cover opening firewall ports for the handshake. Currently only create_method = standalone
and renew_method = cron
are covered, but the role is prepared for implementation of other methods in the future.
Due to some major issues, currently create_challenge = tls-sni
is not supported from letsencrypt.org.
Certbot is a tool to issue SSL/TLS certificates from letsencrypt.org. Having a SSL/TLS certificate is a one of the major things to consider for any Webserver. With letsencrypt you will get one free.
Install from Ansible Galaxy
ansible-galaxy install while_true_do.certbot
Install from Github
git clone https://github.com/while-true-do/ansible-role-certbot.git while_true_do.certbot
Used Modules:
while_true_do.repo_epel is needed to get the certbot packages and dependencies.
ansible-galaxy install -r requirements.yml
Below you can find all variables used. You need to set some of the variables manually.
Mandatory Variables:
You must set a valid contact.
wtd_certbot_create_contact: "[email protected]"
You must configure daemons, which may use the ports already.
wtd_certbot_create_stop_daemons: ["httpd"]
You should configure domains, which should be created. Default is the inventory Hostname.
wtd_certbot_create_domains: ["foo.domain.com","bar.domain.com"]
Default Variables:
---
# defaults/main.yml for certbot
#
# You can set the state to ["present"|"absent"|"latest"]
wtd_certbot_state: "present"
wtd_certbot_packages: ["certbot"]
# Here you can define, if/how a certificate is created
wtd_certbot_create: True
wtd_certbot_create_method: "standalone"
wtd_certbot_create_domains: ["{{ inventory_hostname }}"]
# You have to provide a valid mail address
wtd_certbot_create_contact: ""
# Currently only tls-sni and http are supported.
# You have to assure that the firewall port is openend.
# http = 80/tcp, tls-sni = 443/tcp.
wtd_certbot_create_challenges: "http"
# Standalone Method needs a port to create a cert.
# Therefore all other daemons, which may use this
# port must be stopped during creation.
wtd_certbot_create_stop_daemons: []
# Here you have to define, if/how the renewal will happen
# According to letsencrypt, 2 times a day is a good idea.
wtd_certbot_renew: True
wtd_certbot_renew_method: "cron"
wtd_certbot_renew_hour: "0,12"
wtd_certbot_renew_minute: 0
Simple Example:
- hosts: servers
roles:
- { role: while_true_do.certbot, wtd_certbot_create_contact: [email protected] }
All tests are located in test directory.
Basic testing:
bash ./tests/test-ansible.sh
bash ./tests/test-spelling.sh
bash ./tests/test-whitespace.sh
Thank you so much for considering to contribute. Every contribution helps us. We are really happy, when somebody is joining the hard work. Please have a look at the links first.
This work is licensed under a BSD License.
Blog: blog.while-true-do.org
Mail: [email protected]