usegalaxy-eu / ansible-certbot Goto Github PK

Currently the role combines all of the domains in certbot_domains into a single execution of certbot certonly ... -d {{ ','.join(certbot_domains) }}, which gets you a single cert with multiple subjectAltNames. It's desirable in some cases to use SNI instead and thus get multiple certs (which themselves may have subjectAltNames).

This could be done in a multitude of ways, maybe the simplest would be a new variable:

certbot_sni_domains:
  example.org:
    - example.org
    - www.example.org
  example.com:  # no sANs

This should just need to run the certbot certonly task in request-cert.yml once per dict key in order to generate the certs.

The role fail to run because the certbot_agree_tos is not documented or has no default, I had to figure out myself to set the variable to --agree-tos on my host variables.

I like the idea to have the possibility to write some custom post-renewal scripts but I don't understand the purpose of this code especially if you renew multiple domains certificates as only the first one will be copied.

Maybe adding some condition here will help create a cleaner scripts for those who don't want this part ?

# Chai
cp {{ certbot_letsencrypt_dir }}/live/{{ certbot_hostname_override | default(certbot_domains[0]) }}/fullchain.pem /etc/ssl/certs/fullchain.pem
chmod 644           /etc/ssl/certs/fullchain.pem
chown root:{{ certbot_ssl_group | default('') }} /etc/ssl/certs/fullchain.pem
# Cert
cp {{ certbot_letsencrypt_dir }}/live/{{ certbot_hostname_override | default(certbot_domains[0]) }}/cert.pem      /etc/ssl/certs/cert.pem
chmod 644           /etc/ssl/certs/cert.pem
chown root:{{ certbot_ssl_group | default('') }} /etc/ssl/certs/cert.pem
# Privkey
cp {{ certbot_letsencrypt_dir }}/live/{{ certbot_hostname_override | default(certbot_domains[0]) }}/privkey.pem   /etc/ssl/private/privkey.pem
chmod 640           /etc/ssl/private/privkey.pem
chown root:{{ certbot_ssl_group | default('') }} /etc/ssl/private/privkey.pem