saltstack-formulas/nginx-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

deploy certificates directly from pillar

Browse Source 
... by providing a pillar string. I developed this for use in
combination with ext_pillar and file_tree to deploy letsencrypt
certificates.
This commit is contained in:
Maximilian Eschenbacher 2018-10-04 16:26:37 +02:00
parent 3a5b51940e
commit cb030b04ac
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
nginx/ng/certificates.sls
View File

@ -36,17 +36,25 @@ nginx_{{ domain }}_ssl_certificate:
file.managed: file.managed:
- name: {{ certificates_path }}/{{ domain }}.crt - name: {{ certificates_path }}/{{ domain }}.crt
- makedirs: True - makedirs: True
{% if salt['pillar.get']("nginx:ng:certificates:{}:public_cert_pillar".format(domain)) %}
- contents_pillar: {{salt['pillar.get']('nginx:ng:certificates:{}:public_cert_pillar'.format(domain))}}
{% else %}
- contents_pillar: nginx:ng:certificates:{{ domain }}:public_cert - contents_pillar: nginx:ng:certificates:{{ domain }}:public_cert
{% endif %}
- watch_in: - watch_in:
- service: nginx_service - service: nginx_service
{% if salt['pillar.get']("nginx:ng:certificates:{}:private_key".format(domain)) %} {% if salt['pillar.get']("nginx:ng:certificates:{}:private_key".format(domain)) or salt['pillar.get']("nginx:ng:certificates:{}:private_key_pillar".format(domain))%}
nginx_{{ domain }}_ssl_key: nginx_{{ domain }}_ssl_key:
file.managed: file.managed:
- name: {{ certificates_path }}/{{ domain }}.key - name: {{ certificates_path }}/{{ domain }}.key
- mode: 600 - mode: 600
- makedirs: True - makedirs: True
{% if salt['pillar.get']("nginx:ng:certificates:{}:private_key_pillar".format(domain)) %}
- contents_pillar: {{salt['pillar.get']('nginx:ng:certificates:{}:private_key_pillar'.format(domain))}}
{% else %}
- contents_pillar: nginx:ng:certificates:{{ domain }}:private_key - contents_pillar: nginx:ng:certificates:{{ domain }}:private_key
{% endif %}
- watch_in: - watch_in:
- service: nginx_service - service: nginx_service
{% endif %} {% endif %}

5
pillar.example
View File

@ -182,6 +182,11 @@ nginx:
# control (or use encrypted pillar data). # control (or use encrypted pillar data).
certificates: certificates:
'www.example.com': 'www.example.com':
# choose one of: deploying this cert by pillar (e.g. in combination with ext_pillar and file_tree)
# public_cert_pillar: certs:example.com:fullchain.pem
# private_key_pillar: certs:example.com:privkey.pem
# or directly pasting the cert
public_cert: | public_cert: |
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: www.example.com.crt) (Your Primary SSL certificate: www.example.com.crt)