{"action":"created","issue":{"url":"https://api.github.com/repos/debops/ansible-pki/issues/33","labels_url":"https://api.github.com/repos/debops/ansible-pki/issues/33/labels{/name}","comments_url":"https://api.github.com/repos/debops/ansible-pki/issues/33/comments","events_url":"https://api.github.com/repos/debops/ansible-pki/issues/33/events","html_url":"https://github.com/debops/ansible-pki/pull/33","id":124958677,"number":33,"title":"Redesign 'debops.pki' role, add external CA and ACME support","user":{"login":"drybjed","id":1043958,"avatar_url":"https://avatars.githubusercontent.com/u/1043958?v=3","gravatar_id":"","url":"https://api.github.com/users/drybjed","html_url":"https://github.com/drybjed","followers_url":"https://api.github.com/users/drybjed/followers","following_url":"https://api.github.com/users/drybjed/following{/other_user}","gists_url":"https://api.github.com/users/drybjed/gists{/gist_id}","starred_url":"https://api.github.com/users/drybjed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drybjed/subscriptions","organizations_url":"https://api.github.com/users/drybjed/orgs","repos_url":"https://api.github.com/users/drybjed/repos","events_url":"https://api.github.com/users/drybjed/events{/privacy}","received_events_url":"https://api.github.com/users/drybjed/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-01-05T12:32:45Z","updated_at":"2016-01-08T23:34:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/debops/ansible-pki/pulls/33","html_url":"https://github.com/debops/ansible-pki/pull/33","diff_url":"https://github.com/debops/ansible-pki/pull/33.diff","patch_url":"https://github.com/debops/ansible-pki/pull/33.patch"},"body":""},"comment":{"url":"https://api.github.com/repos/debops/ansible-pki/issues/comments/170156747","html_url":"https://github.com/debops/ansible-pki/pull/33#issuecomment-170156747","issue_url":"https://api.github.com/repos/debops/ansible-pki/issues/33","id":170156747,"user":{"login":"drybjed","id":1043958,"avatar_url":"https://avatars.githubusercontent.com/u/1043958?v=3","gravatar_id":"","url":"https://api.github.com/users/drybjed","html_url":"https://github.com/drybjed","followers_url":"https://api.github.com/users/drybjed/followers","following_url":"https://api.github.com/users/drybjed/following{/other_user}","gists_url":"https://api.github.com/users/drybjed/gists{/gist_id}","starred_url":"https://api.github.com/users/drybjed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drybjed/subscriptions","organizations_url":"https://api.github.com/users/drybjed/orgs","repos_url":"https://api.github.com/users/drybjed/repos","events_url":"https://api.github.com/users/drybjed/events{/privacy}","received_events_url":"https://api.github.com/users/drybjed/received_events","type":"User","site_admin":false},"created_at":"2016-01-08T23:34:18Z","updated_at":"2016-01-08T23:34:18Z","body":"At the moment Let's Encrypt doesn't support wildcards, last I've heard it is planned, but who knows when it will be available.\r\n\r\nFor ACME integration, I want to use `acme-tiny` as well. I imagine that the trigger enabling ACME should at least be the `debops.nginx` role with enabled ACME support - otherwise there's no way for the `acme-tiny` script to publish the challenge to the server. Another factor should be availability of a public IP address (not a private one, not link-local, something that is reachable by Let's Encrypt servers). If a host is not publicly routable, there's no reason to call Let's Encrypt - firewall could forward the packets to an internal host, but that internal host doesn't know that.\r\n\r\nSo, let's say that stars aligned, we have `nginx` configured and a public IP. In that case, role initializes ACME support in each PKI realm by installing `acme-tiny`, creating the `acme/account_key.pem` private key and requesting the certificate using a separate `pki-acme` user account, which should return the certificate to `acme/cert.pem` along with intermediate and root certificates. After that, the `pki-realm` should switch the public certificates to ACME ones and call hooks (not implemented yet) to notify daemons as needed, so for example `nginx` can reload its configuration (not sure if that's needed, but probably yes).\r\n\r\nI'm not sure if you noticed, but if you use dots in a PKI realm name, it will be treated as a domain and used accordingly. if you want to check what kind of requests can be generated, try this:\r\n```\r\npki_realms:\r\n  - name: 'example.com'\r\n    domains: [ 'example.org', 'example.net' ]\r\n    acme_subdomains: [ 'www', 'mail', 'xmpp' ]\r\n```\r\nThis should be enough to generate valid ACME CSR. I'm not sure about the scalability of passing thousands of subdomains through the Bash arguments, but for a small scale it should be fine..."}}