mirror of
https://github.com/KevinMidboe/playbooks-retailor.git
synced 2026-09-07 13:32:06 +00:00
30 lines
997 B
Django/Jinja
30 lines
997 B
Django/Jinja
# ansible_managed
|
|
[Unit]
|
|
Description=Renew ELK TLS certificate via lego (Cloudflare DNS-01)
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
EnvironmentFile={{ elk_cloudflare_token_env_file }}
|
|
ExecStart={{ elk_lego_install_dir }}/lego \
|
|
--accept-tos \
|
|
--email "{{ elk_tls_acme_email }}" \
|
|
--server "{{ elk_tls_acme_server }}" \
|
|
--domains "{{ elk_tls_domain }}" \
|
|
--dns cloudflare \
|
|
--dns.resolvers "1.1.1.1:53,8.8.8.8:53" \
|
|
--path "{{ elk_lego_path }}" \
|
|
--run-hook "/usr/bin/docker compose -f {{ elk_base_dir }}/docker-compose.yml -p {{ elk_compose_project_name }} restart elasticsearch kibana logstash" \
|
|
renew --days {{ elk_tls_renew_days }}
|
|
User=root
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=lego-renew
|
|
|
|
# Light hardening. NoNewPrivileges/ProtectSystem kept loose enough that
|
|
# lego can write certs under elk_lego_path and reach the docker socket
|
|
# via the docker CLI.
|
|
PrivateTmp=yes
|