lego

Issue and renew ACME certificates with Lego on Linux or Windows.

Usage

- hosts: all
  roles:
    - role: giftpilz0.misc.lego

Variables

lego_state_pathpath
private shared Lego state directory containing account keys and certificates.
Default{{ 'C:\ProgramData\lego' if ansible_facts['os_family'] == 'Windows' else '/var/lib/lego' }}
lego_service_userstr
Linux account used to run Lego.
Defaultlego
lego_service_groupstr
Linux group used to run Lego.
Defaultlego
lego_tagstr
Lego release version.
Default5.5.2
lego_archstr
Lego release architecture.
Defaultamd64
lego_pathpath
Lego installation directory.
Default{{ 'C:\ProgramData\lego\bin' if ansible_facts['os_family'] == 'Windows' else '/usr/local/bin' }}
lego_urlstr
Linux Lego archive URL.
Defaulthttps://github.com/go-acme/lego/releases/download/v{{ lego_tag }}/lego_v{{ lego_tag }}_linux_{{ lego_arch }}.tar.gz
lego_windows_urlstr
Windows Lego archive URL.
Defaulthttps://github.com/go-acme/lego/releases/download/v{{ lego_tag }}/lego_v{{ lego_tag }}_windows_{{ lego_arch }}.zip
lego_windows_state_acllist[dict]
Windows identities allowed to access private Lego state.
Default
```
- user: SYSTEM
  rights: FullControl
- user: Administrators
  rights: FullControl
```
- userstrrequired
  Windows identity receiving access.
- rightsstrrequired
  Windows filesystem rights to grant.
lego_windows_task_usernamestr
Windows identity used by the scheduled renewal task.
DefaultSYSTEM
lego_windows_task_logon_typestr
Windows scheduled-task logon type.
Choicesservice_accountpasswords4uinteractive_token
Defaultservice_account
lego_windows_task_passwordstr
Password for a password-based scheduled-task identity.
Default""
lego_binarypath
Lego executable path.
Default{{ lego_path }}/lego
lego_bin_statestr
whether to install Lego or use an existing binary.
Choicespresentskip
Defaultpresent
lego_issue_on_deploybool
issue missing certificates immediately when the role is applied.
Defaultfalse
lego_renewal_thresholdint
renew certificates when fewer than this many days remain.
Default30
lego_acme_emailstr
ACME account email address.
Default""
lego_acme_serverstr
ACME directory URL.
Defaulthttps://acme-v02.api.letsencrypt.org/directory
lego_acme_dns_resolverslist[str]
DNS resolvers passed to Lego for DNS-01 validation.
Default[]
lego_certificateslist[dict]
certificates to issue; each entry must define domains and a challenge.
Default[]
- namestrrequired
  unique identifier used for generated environment files and deployment markers.
- domainslist[str]required
  domain names included in the certificate; the first domain names the output files.
- key_typestr
  Lego private-key type.
  ChoicesRSA2048RSA3072RSA4096EC256EC384EC521
- account_idstr
  optional ACME account directory identifier when one email uses multiple accounts.
- renewaldict
  per-certificate renewal settings.
  - thresholdint
    override the global renewal threshold in days.
- challengedictrequired
  ACME challenge method and provider credentials.
  - typestrrequired
    ACME validation method.
    Choicesdns-01http-01tls-alpn-01
  - providerstr
    Lego DNS provider name; required for dns-01.
  - environmentdict
    provider environment variables, normally populated from Ansible Vault.
- deploydict
  optional certificate deployment targets.
  - pemdict
    Linux PEM deployment.
    - directorypathrequired
      target directory for fullchain.pem and privkey.pem.
    - ownerstr
      owner of the deployed files and directory.
    - groupstr
      group of the deployed files and directory.
    - directory_modestr
      target directory mode.
    - certificate_modestr
      fullchain.pem mode.
    - private_key_modestr
      privkey.pem mode.
  - pfxdict
    PFX deployment for Windows or applications that consume a PFX file.
    - pathpathrequired
      target PFX path.
    - passwordstrrequired
      password used to protect the PFX.
    - ownerstr
      owner of the PFX on Linux.
    - groupstr
      group of the PFX on Linux.
    - modestr
      mode of the PFX on Linux.
    - directory_modestr
      parent directory mode on Linux.
  - windows_storedict
    optional Windows certificate-store import for a deployed PFX.
    - store_locationstr
      Windows certificate-store location.
      ChoicesCurrentUserLocalMachine
    - store_namestr
      Windows certificate-store name.
- hooksdict
  commands run only after a changed certificate is deployed.
  - changedlist[dict]
    - typestr
      informational; Linux runs command, Windows runs script.
      Choicescommandpowershell
    - commandstr
      shell command used by a Linux hook.
    - scriptstr
      PowerShell script used by a Windows hook.
- extra_argslist[str]
  additional Lego arguments for this certificate.

lego_certificate_defaultsdict

values for keys missing in lego_certificates entries (merged recursively).

Default

key_type: EC256
account_id: '{{ lego_acme_email }}'
extra_args: []
renewal:
  threshold: '{{ lego_renewal_threshold }}'
challenge:
  environment: {}
hooks:
  changed: []
deploy: {}

lego_default_deploy_directory_modestr
default mode for Linux certificate deployment directories.
Default0750
lego_default_deploy_file_modestr
default mode for Linux deployed certificate files.
Default0640
lego_default_deploy_private_key_modestr
default mode for Linux deployed private keys.
Default0640

lego_deploy_pem_defaultsdict

values for keys missing in deploy.pem.

Default

owner: root
group: root
directory_mode: '{{ lego_default_deploy_directory_mode }}'
certificate_mode: '{{ lego_default_deploy_file_mode }}'
private_key_mode: '{{ lego_default_deploy_private_key_mode }}'

lego_deploy_pfx_defaultsdict
values for keys missing in deploy.pfx.
Default
```
owner: root
group: root
directory_mode: '0700'
mode: '0600'
```
lego_deploy_windows_store_defaultsdict
values for keys missing in deploy.windows_store.
Default
```
store_location: LocalMachine
store_name: My
```
lego_extra_argslist[str]
additional Lego arguments passed to every certificate.
Default[]