system-config/playbooks/zuul/templates/group_vars/letsencrypt.yaml.j2
Ian Wienand 3aaf87ee6d letsencrypt: Register email with accounts
Currently we don't set a contact email with our accounts.  This is an
optional feature, but would be helpful for things like [1] where we
would be notified of certificates affected by bugs, etc.

Setup the email address in the acme.sh config which will apply with
any new accounts created.  To update all the existing hosts, we see if
the account email is added/modified in the config *and* if we have
existing account details; if so we need a manual update call.

For anyone who might be poking here, we also add a note on sharing an
account based on some broadly agreed upon discussion in IRC.

[1] https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864

Change-Id: Ib4dc3e179010419a1b18f355d13b62c6cc4bc7e8
2020-03-05 12:25:56 +11:00

8 lines
376 B
Django/Jinja

# We don't want CI tests trying to really authenticate against
# letsencrypt; apart from just being unfriendly it might cause quota
# issues. As we don't have the authentication keys exposed in the
# gate, only generate a place-holder self-signed cert for testing.
letsencrypt_use_staging: True
letsencrypt_self_sign_only: True
letsencrypt_account_email: le-test@opendev.org