certbot

get a Let's Encrypt certificate

The step runs certbot certonly. Renewal stays with certbot's own timer. Install the package certbot in an earlier pkg step. The nginx and apache authenticators also need python3-certbot-nginx or python3-certbot-apache.

Keys

certbot.name

string, required

Certificate name in /etc/letsencrypt.

certbot.domains

string or list of strings, required

No wildcards. A wildcard needs a DNS challenge.

certbot.email

string, required

Let's Encrypt account address.

certbot.authenticator

string, default nginx

Challenge plugin: nginx, apache, standalone, or webroot. The nginx and apache plugins do not change the config of the web server. When a challenge runs, they reload it, and the plan says so. standalone binds port 80 itself; pre_hook and post_hook can stop and start what holds that port. webroot needs webroot_path.

certbot.webroot_path

string

Web root for webroot.

certbot.pre_hook

string

Command before each try to get a certificate. certbot stores it in a file that other users can read, so it cannot hold a secret. A hook that needs a secret reads it from a root-only file that a file step writes.

certbot.post_hook

string

Command after each try to get a certificate. certbot stores it in a file that other users can read, so it cannot hold a secret.

certbot.deploy_hook

string

Command after each new certificate, also the first. A failed hook fails the step, and the next apply runs it again. It cannot hold a secret.

certbot.reuse_key

boolean, default false

Keep the private key at renewal.

Example

- certbot:
    name: mail
    domains: [mail.example.com]
    email: admin@example.com
    deploy_hook: systemctl reload postfix