<commit_before>letsencrypt.sh
==============

Install and configure
[`letsencrypt.sh`](https://github.com/lukas2511/letsencrypt.sh).
Create user for privilege dropping and cron configuration for certificate
renewals.


**letsencrypt.sh is working with your private keys so be careful and review
the code of this [ansible role](https://github.com/martin-v/ansible-letsencryptsh)
an the used [letsencrypt.sh script](https://github.com/lukas2511/letsencrypt.sh/blob/2099c77fee3e7a15c5cea93063248af4569bf8de/letsencrypt.sh).**


To create certificates on ansible deployment, you can call the regular cron
script: `shell: "/etc/cron.weekly/letsencrypt.sh"`. The folder `tests` contain
a full running example.


For import from official letsencrypt client take a look at
[letsencrypt.sh import wiki page](https://github.com/lukas2511/letsencrypt.sh/wiki/Import-from-official-letsencrypt-client).


Requirements
------------

The role installs on host:
  - openssl
  - curl
  - sed
  - grep
  - mktemp
  - git

This role need a webserver who serves the directory configured in `lcsh_challengesdir`
(default: `/var/www/letsencrypt.sh/`) at location
`http://<your-domain>/.well-known/acme-challenge/` for all certificate
request domains.


Role Variables
--------------

### Required Variables:

#### lcsh_contactemail

Address for the letsencrypt account. Mostly for certificate expiration notices,
but should be not happen if the cron job works fine.

    lcsh_contactemail: <EMAIL>


#### lcsh_domanins

List of domains for certificate requests. For each line a certificate will
be created, in folder `/etc/letsencrypt.sh/certs/` with the name of the first
domain in line. The first domain is the common name, the other in line will
be alternate names for the certificate.

    lcsh_domanins: |
      example.com
      example.org www.example.org blog.example.org


#### lcsh_deploy_cert

The Certificates must be readable for services like apache or dovecot.
But only the specific services should be allowed to read the certificate
for this service. So we must change the owner/group to a specific value
for each certificate. For security reasons this can be only done by root
user.

To have a generic solution the variable `lcsh_deploy_cert`
exists. This variable must contain bash script for certificate
deployments. Typical tasks on deployment are copy certificate to other
directories, change file owner/permissions and restart services.

This code is called similar as normal letsencrypt.sh hooks, but after the
complete letsencrypt.sh run and with root permissions. The code is called
once for each certificate that has been produced.

Parameters:
- `DOMAIN`
  The primary domain name, i.e. the certificate common name (CN).
- `KEYFILE`
  The path of the file containing the private key.
- `CERTFILE`
  The path of the file containing the signed certificate.
- `FULLCHAINFILE`
  The path of the file containing the full certificate chain.
- `CHAINFILE`
  The path of the file containing the intermediate certificate(s).


    lcsh_deploy_cert: |
      mkdir -p /etc/nginx/ssl/${DOMAIN}
      cp "${KEYFILE}" "${CERTFILE}" "${FULLCHAINFILE}" "${CHAINFILE}" /etc/nginx/ssl/${DOMAIN}
      chown root:root /etc/nginx/ssl/${DOMAIN}/*
      chmod 600 /etc/nginx/ssl/${DOMAIN}/*
      systemctl restart nginx.service


### Optional Variables:

#### lcsh_challengesdir

Directory for acme-challenge files. Your webserver should make this directory
public on location `http://<your-domain>/.well-known/acme-challenge/` for all domains listed
before. This directory will be created if it not exist. It should be only
writable for letsencrypt.sh user and readable by your webserver, this will
be enforced by this role.

    lcsh_challengesdir: /var/www/letsencrypt.sh/


#### More variables

There are also some unusual variables for super user who need more control,
for details take look at `defaults/main.yml`


Dependencies
------------

None.


Example Playbook
----------------

    - hosts: servers
      roles:
        - { role: martin-v.letsencryptsh }
      vars_files:
        - group_vars/letsencryptsh.yml

Example Variables file
----------------------

    ---

    lcsh_contactemail: <EMAIL>

    lcsh_domanins: |
      example.com
      example.org www.example.org blog.example.org

    lcsh_deploy_cert: |
      mkdir -p /etc/nginx/ssl/${DOMAIN}
      cp "${KEYFILE}" "${CERTFILE}" "${FULLCHAINFILE}" "${CHAINFILE}" /etc/nginx/ssl/${DOMAIN}
      chown root:root /etc/nginx/ssl/${DOMAIN}/*
      chmod 600 /etc/nginx/ssl/${DOMAIN}/*
      systemctl restart nginx.service


Open tasks
----------

[![Build Status](https://travis-ci.org/martin-v/ansible-letsencryptsh.svg?branch=master)](https://travis-ci.org/martin-v/ansible-letsencryptsh)

0. Write <del>more</del> tests
0. Example documentation for nginx and apache configuration


License
-------

MIT

Author Information
------------------

This role was created in 2016 by [<NAME>](https://github.com/martin-v).
<commit_msg>Clean up README for ansible galaxies markdown parser.<commit_after>letsencrypt.sh
==============

Install and configure `letsencrypt.sh`. Create user for privilege dropping
and cron configuration for certificate renewals.


**letsencrypt.sh is working with your private keys so be careful and review
the code of this [ansible role](https://github.com/martin-v/ansible-letsencryptsh)
an the used [letsencrypt.sh script](https://github.com/lukas2511/letsencrypt.sh/blob/2099c77fee3e7a15c5cea93063248af4569bf8de/letsencrypt.sh).**


Requirements
------------

The role installs on host:

  * openssl
  * curl
  * sed
  * grep
  * mktemp
  * git

This role need a webserver who serves the directory configured in `lcsh_challengesdir`
(default: `/var/www/letsencrypt.sh/`) at location
`http://<your-domain>/.well-known/acme-challenge/` for all certificate
request domains.


Role Variables
--------------

### Required Variables:

#### lcsh_contactemail

Address for the letsencrypt account. Mostly for certificate expiration notices,
but should be not happen if the cron job works fine.

    lcsh_contactemail: <EMAIL>


#### lcsh_domanins

List of domains for certificate requests. For each line a certificate will
be created, in folder `/etc/letsencrypt.sh/certs/` with the name of the first
domain in line. The first domain is the common name, the other in line will
be alternate names for the certificate.

    lcsh_domanins: |
      example.com
      example.org www.example.org blog.example.org


#### lcsh_deploy_cert

The Certificates must be readable for services like apache or dovecot.
But only the specific services should be allowed to read the certificate
for this service. So we must change the owner/group to a specific value
for each certificate. For security reasons this can be only done by root
user.

To have a generic solution the variable `lcsh_deploy_cert`
exists. This variable must contain bash script for certificate
deployments. Typical tasks on deployment are copy certificate to other
directories, change file owner/permissions and restart services.

This code is called similar as normal letsencrypt.sh hooks, but after the
complete letsencrypt.sh run and with root permissions. The code is called
once for each certificate that has been produced.

Parameters:

* `DOMAIN`
  The primary domain name, i.e. the certificate common name (CN).
* `KEYFILE`
  The path of the file containing the private key.
* `CERTFILE`
  The path of the file containing the signed certificate.
* `FULLCHAINFILE`
  The path of the file containing the full certificate chain.
* `CHAINFILE`
  The path of the file containing the intermediate certificate(s).

Example:

    lcsh_deploy_cert: |
      mkdir -p /etc/nginx/ssl/${DOMAIN}
      cp "${KEYFILE}" "${CERTFILE}" "${FULLCHAINFILE}" "${CHAINFILE}" /etc/nginx/ssl/${DOMAIN}
      chown root:root /etc/nginx/ssl/${DOMAIN}/*
      chmod 600 /etc/nginx/ssl/${DOMAIN}/*
      systemctl restart nginx.service


### Optional Variables:

#### lcsh_challengesdir

Directory for acme-challenge files. Your webserver should make this directory
public on location `http://<your-domain>/.well-known/acme-challenge/` for all domains listed
before. This directory will be created if it not exist. It should be only
writable for letsencrypt.sh user and readable by your webserver, this will
be enforced by this role.

    lcsh_challengesdir: /var/www/letsencrypt.sh/


#### More variables

There are also some unusual variables for super user who need more control,
for details take look at `defaults/main.yml`


Dependencies
------------

None.


Example Playbook
----------------

    - hosts: all
      remote_user: root
      vars_files:
        - letsencryptsh_vars.yml
      roles:
        - martin-v.letsencryptsh



Example variables file
----------------------

    ---

    lcsh_contactemail: <EMAIL>

    lcsh_domanins: |
      example.com
      example.org www.example.org blog.example.org

    lcsh_deploy_cert: |
      mkdir -p /etc/nginx/ssl/${DOMAIN}
      cp "${KEYFILE}" "${CERTFILE}" "${FULLCHAINFILE}" "${CHAINFILE}" /etc/nginx/ssl/${DOMAIN}
      chown root:root /etc/nginx/ssl/${DOMAIN}/*
      chmod 600 /etc/nginx/ssl/${DOMAIN}/*
      systemctl restart nginx.service


Tips
----

To create certificates on ansible deployment, you can call the regular cron
script: `shell: "/etc/cron.weekly/letsencrypt.sh"`. The
[folder `tests`](https://github.com/martin-v/ansible-letsencryptsh/tree/master/tests)
contain a full running example.


For import from official letsencrypt client take a look at
[letsencrypt.sh import wiki page](https://github.com/lukas2511/letsencrypt.sh/wiki/Import-from-official-letsencrypt-client).


Open tasks
----------

[![Build Status](https://travis-ci.org/martin-v/ansible-letsencryptsh.svg?branch=master)](https://travis-ci.org/martin-v/ansible-letsencryptsh)

0. Write <del>more</del> tests
0. Example documentation for nginx and apache configuration


License
-------

MIT

Author Information
------------------

This role was created in 2016 by [<NAME>](https://github.com/martin-v).

{'fraction_non_alphanumeric': 0.11414663222729982, 'fraction_numerical': 0.009139678124379097, 'mean_word_length': 3.4941964285714286, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 17, 'https://': 14, 'lorem ipsum': 0, 'www.': 8, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1384888', 'n_tokens_mistral': 3140, 'n_tokens_neox': 2951, 'n_words': 1046}