Setup acme.sh in dns api mode via ansible to generate letsencrypt.org certs.
A lot of defaults assume using nginx.
Here are some defaults that control behavior:
acme_sh_autoupgrade: True
acme_sh_notify: False
acme_sh_logging: False
acme_sh_keylength: 4096
acme_sh_dns_sleep: 120
acme_sh_certs_public_dir: /etc/nginx/certs
acme_sh_certs_private_dir: /etc/nginx/private
acme_sh_reload_cmd: sudo /bin/systemctl reload nginx
Here is an example using AWS Route53 API. But you could modify it for any dns api provider.
Usage:
- hosts: servers
roles:
- role: thermistor.acme_sh
acme_sh_subject_names:
- example.com
- www.example.com
acme_sh_dns_provider: dns_aws
acme_sh_env:
AWS_ACCESS_KEY_ID: "{{ your_vault_aws_access_key_id }}"
AWS_SECRET_ACCESS_KEY: "{{ your_vault_aws_secret_access_key }}"
here is the same example but with logging added:
- hosts: servers
roles:
- role: thermistor.acme_sh
acme_sh_logging: True
acme_sh_subject_names:
- example.com
- www.example.com
acme_sh_dns_provider: dns_aws
acme_sh_env:
AWS_ACCESS_KEY_ID: "{{ your_vault_aws_access_key_id }}"
AWS_SECRET_ACCESS_KEY: "{{ your_vault_aws_secret_access_key }}"
and with mailgun notifications:
- hosts: servers
roles:
- role: thermistor.acme_sh
acme_sh_notify: True
acme_sh_notify_hooks:
- mailgun
acme_sh_subject_names:
- example.com
- www.example.com
acme_sh_dns_provider: dns_aws
acme_sh_env:
AWS_ACCESS_KEY_ID: "{{ your_vault_aws_access_key_id }}"
AWS_SECRET_ACCESS_KEY: "{{ your_vault_aws_secret_access_key }}"
MAILGUN_API_KEY: "{{ your_vault_mailgun_api_key }}"
MAILGUN_API_DOMAIN: "{{ your_vault_mailgun_domain }}"
MAILGUN_FROM: "{{ your_vault_mailgun_from }}"
MAILGUN_TO: "{{ your_vault_mailgun_to }}"
If you generate a cert for example.com, during the install step this role will copy the /var/lib/acme/.acme.sh/example.com/fullchain.cer and install it as /etc/nginx/certs/example.com.cer. Note that it is installing the fullchain
cert and renaming it, this is so that you can install multiple fullchain certs for different domains if necessary.
If there are cert misconfiguration issues sometimes you can get into a wedged state where certs are not being reinstalled, you can force the certs to be reinstalled with:
ansible-playbook -i inventory playbook.yml -e "acme_sh_force_install=True" --tags acme_sh_cert_install
MIT
We borrowed a lot from these alternatives:
- nickjj.acme_sh - multi cert capable
- verosk.acme-sh - just install
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent