panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
21 lines
911 B
Django/Jinja
21 lines
911 B
Django/Jinja
#!/usr/bin/env bash
|
|
# {{ ansible_managed }}
|
|
# Obtain or renew bao's Let's Encrypt cert via Cloudflare DNS-01. lego's `run` does both:
|
|
# it renews only when due (ARI + --renew-days) and fires --deploy-hook on any actual
|
|
# create/renew to install the cert and reload bao. CLOUDFLARE_DNS_API_TOKEN comes from
|
|
# the environment (systemd EnvironmentFile, or Ansible on the first run).
|
|
set -euo pipefail
|
|
|
|
exec {{ openbao_acme_bin }} run \
|
|
--accept-tos \
|
|
--email "{{ openbao_acme_email }}" \
|
|
--dns cloudflare \
|
|
--dns.resolvers "{{ openbao_acme_dns_resolvers }}" \
|
|
--dns.timeout {{ openbao_acme_dns_timeout }} \
|
|
--dns.propagation.wait "{{ openbao_acme_propagation_wait }}" \
|
|
--domains "{{ openbao_acme_domain }}" \
|
|
--path "{{ openbao_acme_dir }}" \
|
|
--renew-days 30 \
|
|
--deploy-hook /usr/local/bin/openbao-acme-deploy.sh{% if openbao_acme_server %} \
|
|
--server "{{ openbao_acme_server }}"{% endif %}
|