Sys-svc-certs Role

Description: Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

Variables

  • author: Kevin Veen-Birkenbach

  • description: Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

  • license: Infinito.Nexus Community License (Non-Commercial)

  • company: Kevin Veen-Birkenbach https://www.veen.world

  • min_ansible_version: 2.9

  • platforms: [{‘name’: ‘ArchLinux’, ‘versions’: [‘all’]}, {‘name’: ‘Debian’, ‘versions’: [‘all’]}, {‘name’: ‘EL’, ‘versions’: [‘all’]}, {‘name’: ‘Fedora’, ‘versions’: [‘all’]}, {‘name’: ‘Ubuntu’, ‘versions’: [‘all’]}]

  • galaxy_tags: [‘nginx’, ‘certbot’, ‘letsencrypt’, ‘ssl’, ‘tls’, ‘acme’, ‘https’, ‘wildcard’, ‘automation’]

  • issue_tracker_url: https://s.infinito.nexus/issues

README

NGINX HTTPS Certificate Retrieval

Description

This role automates the retrieval of Let’s Encrypt SSL/TLS certificates using Certbot for domains served via NGINX. It supports both single-domain and wildcard certificates, and can use either the DNS or webroot ACME challenge methods.

Overview

Designed for Archlinux systems, this role handles issuing certificates per domain and optionally cleans up redundant certificates if wildcard certificates are used. It intelligently decides whether to issue a standard or wildcard certificate based on the domain structure and your configuration.

Key Features

  • Single Domain and Wildcard Support: Handles both individual domains and wildcard domains (*.example.com).

  • DNS and Webroot Challenges: Dynamically selects the correct ACME challenge method.

  • Certificate Renewal Logic: Skips renewal if the certificate is still valid.

  • Optional Cleanup: Deletes redundant domain certificates when wildcard certificates are used.

  • Non-Interactive Operation: Fully automated using --non-interactive and --agree-tos.

Cosmos

The diagram places NGINX HTTPS Certificate Retrieval in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-svc-certs 💻]
        svc_svc_certs["svc-certs"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role’s deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Purpose

The NGINX HTTPS Certificate Retrieval role ensures that your NGINX-served domains have valid, automatically issued SSL/TLS certificates, improving web security without manual intervention.

Features

  • ACME Challenge Selection: Supports DNS plugins or webroot method automatically.

  • Wildcard Certificate Management: Issues wildcard certificates when configured, saving effort for subdomain-heavy deployments.

  • Safe Cleanup: Ensures that no unused certificates are left behind.

  • Flexible Control: Supports for MODE_CLEANUP for cert cleanup operations.

Learn More

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).