panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
42 lines
2.2 KiB
YAML
42 lines
2.2 KiB
YAML
---
|
|
# openbao_acme role defaults. Cloudflare token comes from group_vars/all/vault.yml.
|
|
|
|
# --- lego (ACME client) release ---
|
|
openbao_acme_version: "5.3.1"
|
|
openbao_acme_checksum: "sha256:b3c71b122ee1947eacfe0b809b955647f6377239fe4bfc49f73b1a091ae1252a"
|
|
openbao_acme_url: "https://github.com/go-acme/lego/releases/download/v{{ openbao_acme_version }}/lego_v{{ openbao_acme_version }}_linux_amd64.tar.gz"
|
|
openbao_acme_bin: "/usr/local/bin/lego"
|
|
|
|
# --- Paths / identity ---
|
|
openbao_acme_dir: "/etc/openbao/acme" # lego state (account, certs, cloudflare.env)
|
|
openbao_acme_tls_dir: "/etc/openbao/tls" # where bao's listener reads cert.pem/key.pem
|
|
openbao_user: "openbao"
|
|
openbao_group: "openbao"
|
|
|
|
# --- Certificate ---
|
|
openbao_acme_domain: "{{ openbao_fqdn }}" # bao.ad.ddupan.top (from group_vars/all)
|
|
openbao_acme_email: "[email protected]" # ACME account / expiry-notice email
|
|
|
|
# Cloudflare API token with Zone:DNS:Edit on ddupan.top. Set vault_openbao_cf_dns_token
|
|
# in group_vars/all/vault.yml (you can copy the value from the cloudflared tunnel's
|
|
# terraform.tfvars, which is scoped the same).
|
|
openbao_acme_cf_token: "{{ vault_openbao_cf_dns_token | default('') }}"
|
|
|
|
# Empty = Let's Encrypt production. To dry-run without burning rate limits, set:
|
|
# https://acme-staging-v02.api.letsencrypt.org/directory
|
|
openbao_acme_server: ""
|
|
|
|
# Resolvers for lego's zone/apex detection. Must give the PUBLIC view: both the DC AND
|
|
# the LAN gateway forward ad.ddupan.top to the DC (split-horizon) → they'd resolve the
|
|
# zone to the non-existent CF zone "ad.ddupan.top". Only real public resolvers see that
|
|
# ad.ddupan.top isn't delegated and return the ddupan.top apex. List several so a flaky
|
|
# WAN query to one falls through to another.
|
|
openbao_acme_dns_resolvers: "1.1.1.1:53,1.0.0.1:53,8.8.8.8:53,9.9.9.9:53"
|
|
openbao_acme_dns_timeout: 30 # per-query DNS timeout (s); default 10 is tight over a flaky WAN
|
|
# Skip the 2-min propagation polling (many WAN DNS queries); just wait, then ask LE to
|
|
# validate (LE queries public DNS itself, independent of this host's WAN).
|
|
openbao_acme_propagation_wait: "120s"
|
|
|
|
# Renewal timer (lego only renews within --days of expiry).
|
|
openbao_acme_renew_oncalendar: "*-*-* 03:17:00"
|