60 lines
1.7 KiB
Text
60 lines
1.7 KiB
Text
let _concerns_lib = import "schemas/lib/concerns.ncl" in
|
|
|
|
{
|
|
AcmeCertd = {
|
|
name | String,
|
|
version | String,
|
|
mode | [| 'systemd_timer |],
|
|
|
|
acme_sh_version | String,
|
|
|
|
# ACME server endpoint — letsencrypt | letsencrypt_test | zerossl
|
|
server | [| 'letsencrypt, 'letsencrypt_test, 'zerossl |] | default = 'letsencrypt,
|
|
|
|
# acme.sh DNS plugin name — e.g. dns_cf (Cloudflare), dns_he, dns_aws
|
|
dns_provider | String,
|
|
|
|
# SOPS ref to the DNS API token resolved at deploy time
|
|
dns_token_ref | String,
|
|
|
|
# Domains to issue — supports wildcards (e.g. "*.librecloud.online")
|
|
domains | Array String,
|
|
|
|
# Email for ACME account registration and expiry notifications
|
|
acme_email | String,
|
|
|
|
# Directory where issued certs are installed
|
|
cert_dir | String | default = "/etc/ssl/acme",
|
|
|
|
# systemd timer interval for renewal checks
|
|
renewal_check | String | default = "12h",
|
|
|
|
# OS user acme.sh runs as (created if absent)
|
|
user | String | default = "acme",
|
|
group | String | default = "acme",
|
|
|
|
# Commands to run after a successful renewal (e.g. systemctl reload nginx)
|
|
reload_hooks | Array String | default = [],
|
|
|
|
requires | {
|
|
credentials | Array String | default = [],
|
|
capabilities | Array String | default = [],
|
|
} | default = {},
|
|
|
|
provides | {
|
|
service | String | optional,
|
|
interface | String | optional,
|
|
} | default = {},
|
|
|
|
operations | {
|
|
install | Bool | default = true,
|
|
update | Bool | default = true,
|
|
delete | Bool | default = false,
|
|
health | Bool | default = true,
|
|
} | default = {},
|
|
|
|
concerns | _concerns_lib.ServiceConcerns | optional,
|
|
|
|
..
|
|
},
|
|
}
|