kris/puppet-acme_vault
1
0
Fork 0
mirror of https://github.com/krislamo/puppet-acme_vault synced 2024-09-19 20:40:36 +00:00
Code Issues Releases Wiki Activity

Update readme to reflect deploy scripts addition

Browse Source
This commit is contained in:
Kris Lamoureux 2020-08-11 17:25:20 -04:00
parent 0e9e7262b4
commit ee9416b82f
1 changed files with 29 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
README.md
View File

@ -18,7 +18,7 @@ This module uses [acme.sh](https://github.com/Neilpang/acme.sh) to request
letsencrypt certificates using the DNS-01 challenge. Once valid certificates letsencrypt certificates using the DNS-01 challenge. Once valid certificates
are recieved, they are stored in [Hashicorp are recieved, they are stored in [Hashicorp
vault](https://www.vaultproject.io/) where they can be retrieved by any vault](https://www.vaultproject.io/) where they can be retrieved by any
appropriate machine. appropriate machine.
This module consists of a common class, a request class, and a deploy class. This module consists of a common class, a request class, and a deploy class.
The request class is intended to be enabled on a single machine that will The request class is intended to be enabled on a single machine that will
@ -36,11 +36,11 @@ python library is also included. Both are installed via pip.
This module also assumes a working installation of vault. This module also assumes a working installation of vault.
### Beginning with acme_vault ### Beginning with acme_vault
Just include the appropriate modules for the appropriate machines, and make Just include the appropriate modules for the appropriate machines, and make
sure the required values are provided via hiera or class. Note: the common sure the required values are provided via hiera or class. Note: the common
module must be included before either. module must be included before either.
Typically this would involve a profile like: Typically this would involve a profile like:
@ -76,13 +76,13 @@ vault, vault vars, and cron mailto are needed for both request and deploy
##### `user` ##### `user`
user to be created to request/deploy certs user to be created to request/deploy certs
Default value: `acme_vault` Default value: `acme_vault`
##### `group` ##### `group`
group that the user belongs to. For deploy, this should probably be the webserver group group that the user belongs to. For deploy, this should probably be the webserver group
Default value: `acme_vault` Default value: `acme_vault`
@ -102,7 +102,7 @@ Default value: `''`
mapping of domains to be included in the cert. The key is the "main" domain, mapping of domains to be included in the cert. The key is the "main" domain,
and the value is the list of extra names to be requested. Both the main domain and the value is the list of extra names to be requested. Both the main domain
and the list of domains are included. and the list of domains are included.
REQUIRED REQUIRED
@ -128,7 +128,7 @@ Default value: `${home_dir}/vault"`
#### `vault_prefix` #### `vault_prefix`
The path within vault where the certificates will be stored and retrieved. The path within vault where the certificates will be stored and retrieved.
Default value: `/secret/letsencrypt/` Default value: `/secret/letsencrypt/`
@ -147,13 +147,13 @@ can be triggered by running the cron job manually as needed.
##### `user` ##### `user`
user to be created to request/deploy certs user to be created to request/deploy certs
Default value: `acme_vault` Default value: `acme_vault`
##### `group` ##### `group`
group that the user belongs to. For deploy, this should probably be the webserver group group that the user belongs to. For deploy, this should probably be the webserver group
Default value: `acme_vault` Default value: `acme_vault`
@ -173,7 +173,7 @@ Default value: `''`
mapping of domains to be included in the cert. The key is the "main" domain, mapping of domains to be included in the cert. The key is the "main" domain,
and the value is the list of extra names to be requested. Both the main domain and the value is the list of extra names to be requested. Both the main domain
and the list of domains are included. and the list of domains are included.
REQUIRED REQUIRED
@ -202,37 +202,37 @@ Default value: `https://acme-v02.api.letsencrypt.org/directory`
#### `acme_revision` #### `acme_revision`
git revision/tag to be used to checkout acme.sh repository. git revision/tag to be used to checkout acme.sh repository.
Default value: `HEAD` Default value: `HEAD`
#### `acme_repo_path` #### `acme_repo_path`
where the repo should be checked out. where the repo should be checked out.
Default value: `$home_dir/acme.sh` Default value: `$home_dir/acme.sh`
#### `acme_script` #### `acme_script`
path the the acme.sh script itself path the the acme.sh script itself
Default value: `$acme_repo_path/acme.sh` Default value: `$acme_repo_path/acme.sh`
#### `lexicon_provider` #### `lexicon_provider`
provider for lexicon to use for dns-01 challanges. provider for lexicon to use for dns-01 challanges.
REQUIRED REQUIRED
#### `lexicon_username` #### `lexicon_username`
username for lexicon dns. username for lexicon dns.
REQUIRED REQUIRED
#### `lexicon_token` #### `lexicon_token`
token for lexicon user. token for lexicon user.
REQUIRED REQUIRED
@ -249,13 +249,13 @@ is appropriate to replace the existing one
##### `user` ##### `user`
user to be created to request/deploy certs user to be created to request/deploy certs
Default value: `acme_vault` Default value: `acme_vault`
##### `group` ##### `group`
group that the user belongs to. For deploy, this should probably be the webserver group group that the user belongs to. For deploy, this should probably be the webserver group
Default value: `acme_vault` Default value: `acme_vault`
@ -269,31 +269,31 @@ Default value: `/home/$user`
mapping of domains to be included in the cert. The key is the "main" domain, mapping of domains to be included in the cert. The key is the "main" domain,
and the value is the list of extra names to be requested. Both the main domain and the value is the list of extra names to be requested. Both the main domain
and the list of domains are included. and the list of domains are included.
REQUIRED REQUIRED
#### Parameters only for deploy: #### Parameters only for deploy:
##### `cert_destination_path` ##### `cert_destination_path`
where the cert should be deployed to. cert will end up in $cert_destination_path/$domain/. where the cert should be deployed to. cert will end up in $cert_destination_path/$domain/.
Default value: `/etc/acme-vault` Default value: `/etc/acme`
##### `restart` ##### `deploy_scripts`
indicates if cron should include a restart after cert is deployed location for arbitrary scripts to reload certificates for applications. scripts will end up in $cert_destination_path/deploy.d/
Valid values: `true` `false` Default value: `/etc/acme/deploy.d`
##### `restart_command` ##### `restart_method`
The command used restart any service after cert is deployed shell that is run after successful deployment. runs scripts in $deploy_scripts
Default value: `for f in /etc/acme/deploy.d/*.sh; do "$f"; done`
Default value: `'echo restart!'`
## Limitations ## Limitations
Has only been tested on Centos 7 Has only been tested on Centos 7