Santeri Kainulainen
733c3ed250
This commit includes the pre-generated certs in the files/certs directory. README.md was thoroughly updated to include an example of using certbot with this role and how to import the root.crt to Firefox.
44 lines
No EOL
1.8 KiB
Markdown
44 lines
No EOL
1.8 KiB
Markdown
# Kifi Caddy
|
|
|
|
Installs and configures Caddy for use as a local ACME CA server allowing certificates to be issued in testing.
|
|
This role should function as of now, but for example certificate lifetime changes don't work (defaults to 12h).
|
|
|
|
## Example usage
|
|
|
|
In your playbook, define the role and config paths. Most likely the defaults are fine, so you can just simply add the role. Remember to add this before any certbot role. The ACME server is hosted at port 8443. You can also change the `templates/Caddyfile.j2` to fit your own needs.
|
|
|
|
Example for tilastot.kirjastot.fi.local:
|
|
```
|
|
- role: kifi.caddy
|
|
caddy_config_path: /etc/caddy/Caddyfile
|
|
caddy_root: /var/www/caddy
|
|
caddy_service_name: caddy
|
|
```
|
|
|
|
Another example of how to use this in combination with the kifi.certbot role:
|
|
```
|
|
tasks:
|
|
- name: Run Certbot role
|
|
include_role:
|
|
name: kifi.certbot
|
|
vars:
|
|
certbot_disable_certbot_cron: yes
|
|
certbot_host_with_certs: tilastot.kirjastot.fi.local
|
|
certbot_create_if_missing: yes
|
|
certbot_admin_email: tekniikka@kirjastot.fi
|
|
certbot_certs:
|
|
- domains:
|
|
- tilastot.kirjastot.fi.local
|
|
certbot_create_command: >
|
|
sudo -E REQUESTS_CA_BUNDLE=/var/lib/caddy/.local/share/caddy/pki/authorities/local/root.crt
|
|
certbot certonly --server https://localhost:8443/acme/local/directory
|
|
--standalone
|
|
--email {{ certbot_admin_email }}
|
|
--agree-tos
|
|
--non-interactive
|
|
-d {{ certbot_certs | map(attribute='domains') | flatten | join(' -d ') }}
|
|
tags: certbot, ssl
|
|
```
|
|
|
|
Note that the domains get looped over, so you can have multiple of them.
|
|
Certificates for domains can be found in the folder /etc/letsencrypt/live/domainname though it might be wise to change this |