diff --git a/nginx/ng/certificates.sls b/nginx/ng/certificates.sls index db3e05a..8fdc54f 100644 --- a/nginx/ng/certificates.sls +++ b/nginx/ng/certificates.sls @@ -1,11 +1,12 @@ include: - nginx.ng.service +{% set certificates_path = salt['pillar.get']('nginx:ng:certificates_path', '/etc/nginx/ssl') %} {%- for domain in salt['pillar.get']('nginx:ng:certificates', {}).keys() %} nginx_{{ domain }}_ssl_certificate: file.managed: - - name: /etc/nginx/ssl/{{ domain }}.crt + - name: {{ certificates_path }}/{{ domain }}.crt - makedirs: True - contents_pillar: nginx:ng:certificates:{{ domain }}:public_cert - watch_in: @@ -14,7 +15,7 @@ nginx_{{ domain }}_ssl_certificate: {% if salt['pillar.get']("nginx:ng:certificates:{}:private_key".format(domain)) %} nginx_{{ domain }}_ssl_key: file.managed: - - name: /etc/nginx/ssl/{{ domain }}.key + - name: {{ certificates_path }}/{{ domain }}.key - mode: 600 - makedirs: True - contents_pillar: nginx:ng:certificates:{{ domain }}:private_key diff --git a/pillar.example b/pillar.example index 0f229f4..3c63029 100644 --- a/pillar.example +++ b/pillar.example @@ -132,6 +132,7 @@ nginx: # } # } + certificates_path: '/etc/nginx/ssl' # Use this if you need to deploy below certificates in a custom path. # If you're doing SSL termination, you can deploy certificates this way. # The private one(s) should go in a separate pillar file not in version # control (or use encrypted pillar data).