openstack/openstack-ansible
Code Issues Proposed changes

Merge "Update letsencrypt docs"

Browse Source
This commit is contained in:
Zuul
2023-04-04 14:49:03 +00:00
committed by Gerrit Code Review
parent 7c0ea4f0d6 1a3c3f5603
commit 76cd0c7ed6
2 changed files with 5 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
doc/source/user/security/ssl-certificates.rst
View File

@@ -253,30 +253,6 @@ http-01 challenge requests.
haproxy_ssl_letsencrypt_install_method: "distro"
haproxy_ssl_letsencrypt_email: "email.address@example.com"
If you don't have horizon deployed, you will need to define dummy service that
will listen on 80 and 443 ports and will be used for acme-challenge, whose
backend is certbot on the haproxy host:
.. code-block:: shell-session
haproxy_extra_services:
# the external facing service which serves the apache test site, with a acl for LE requests
- service:
haproxy_service_name: certbot
haproxy_redirect_http_port: 80 #redirect port 80 to port ssl
haproxy_redirect_scheme: "https if !{ ssl_fc } !{ path_beg /.well-known/acme-challenge/ }" #redirect all non-ssl traffic to ssl except acme-challenge
haproxy_port: 443
haproxy_frontend_acls: "{{ haproxy_ssl_letsencrypt_acl }}" #use a frontend ACL specify the backend to use for acme-challenge
haproxy_ssl: True
haproxy_backend_nodes: #apache is running on locally on 127.0.0.1:80 serving a dummy site
- name: local-test-service
ip_addr: 127.0.0.1
haproxy_balance_type: http
haproxy_backend_port: 80
haproxy_backend_options:
- "httpchk HEAD /" # request to use for health check for the example service
TLS for Haproxy Internal VIP
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5
releasenotes/notes/haproxy-base-service-letsencrypt-13436d2a8d9ea4f9.yaml Normal file
View File

@@ -0,0 +1,5 @@
---
other:
- |
After haproxy base service was added, dummy letsencrypt service is
no longer needed for deployments without horizon and should be removed.