Alan Orth
651c01a29b
The variable name is misleading as this really does is install the certbot client and its dependencies, and we generally want this to always happen. If a host doesn't want it, they can override it in their host vars. Perhaps I should rename this variable to "bootstrap_letsencrypt" or something so it is more accurate.
34 lines
830 B
YAML
34 lines
830 B
YAML
---
|
|
# file: roles/nginx/defaults/main.yml
|
|
|
|
# path config
|
|
nginx_confd_path: /etc/nginx/conf.d
|
|
|
|
# parent directory of vhost roots
|
|
nginx_root_prefix: /var/www
|
|
|
|
# 1 hour timeout
|
|
nginx_ssl_session_timeout: 1h
|
|
# 10MB -> 40,000 sessions
|
|
nginx_ssl_session_cache: shared:SSL:10m
|
|
# 1400 bytes to fit in one MTU (default is 16k!)
|
|
nginx_ssl_buffer_size: 1400
|
|
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
|
|
nginx_ssl_protocols: 'TLSv1 TLSv1.1 TLSv1.2'
|
|
|
|
# install certbot + dependencies?
|
|
# True unless you're in development and using "localhost" + snakeoil certs
|
|
use_letsencrypt: True
|
|
|
|
# Directory root for Let's Encrypt certs
|
|
letsencrypt_root: /etc/letsencrypt/live
|
|
|
|
# Location of Let's Encrypt's certbot script
|
|
letsencrypt_certbot_dest: /opt/certbot-auto
|
|
|
|
# stable is 1.10.x
|
|
# mainline is 1.11.x
|
|
nginx_version: mainline
|
|
|
|
# vim: set ts=2 sw=2:
|