search

geerlingguy / ansible-role-certbot

Ansible Role - Certbot (for Let's Encrypt)
https://galaxy.ansible.com/geerlingguy/certbot/
MIT License
789 stars 351 forks source link

New Feature: Create Method DNS / Staging CA / Certificate Delete #163

Closed brunobenchimol closed 2 years ago

brunobenchimol commented 2 years ago

New features:

Documentation:

bugspencor commented 2 years ago

FWIW I managed to acquire a certificate with this branch and RFC2136 method. I would be happy if that feature could be included. Thanks for the effort!

brunobenchimol commented 2 years ago

FWIW I managed to acquire a certificate with this branch and RFC2136 method. I would be happy if that feature could be included. Thanks for the effort!

I am glad to hear that it worked. Meanwhile i created a new role that extends on top of this one. It mimics this PR in fact. Although this PR was done based on v4.2.0 and new role was done based on v5.0.0.

https://galaxy.ansible.com/brunobenchimol/certbot_dns https://github.com/brunobenchimol/ansible-role-certbot-dns

It took me some time to fiddle with molecule to run all the tests but i finally got it right. At least i believe so.

I dont know if @geerlingguy prefer this way instead of fiddling with another 'create method' to maintain. Also this PR breaks compatibility with older OS because they do not pack dns plugins with certbot... it surely could impact his work.

Its a pretty similar from what @michaelpporter (https://github.com/michaelpporter/ansible-role-certbot-cloudflare) did like 3 years ago.

Let me know what you think and how it will be more helpful. Would love to get some feedback!

Best regards,

stale[bot] commented 2 years ago

This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark pull requests as stale.

brunobenchimol commented 2 years ago

Any chances to review this PR to know if it will be accepted or denied?

Best regards,

stale[bot] commented 2 years ago

This issue is no longer marked for closure.

stale[bot] commented 2 years ago

This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark pull requests as stale.

stale[bot] commented 2 years ago

This pull request has been closed due to inactivity. If you feel this is in error, please reopen the pull request or file a new PR with the relevant details.

sgarwood commented 2 years ago

This looks really promising.

Is there some instructions available how we could use this role while the maintainer considers accepting this PR?

brunobenchimol commented 2 years ago

FWIW I managed to acquire a certificate with this branch and RFC2136 method. I would be happy if that feature could be included. Thanks for the effort!

I am glad to hear that it worked. Meanwhile i created a new role that extends on top of this one. It mimics this PR in fact. Although this PR was done based on v4.2.0 and new role was done based on v5.0.0.

https://galaxy.ansible.com/brunobenchimol/certbot_dns https://github.com/brunobenchimol/ansible-role-certbot-dns

It took me some time to fiddle with molecule to run all the tests but i finally got it right. At least i believe so.

I dont know if @geerlingguy prefer this way instead of fiddling with another 'create method' to maintain. Also this PR breaks compatibility with older OS because they do not pack dns plugins with certbot... it surely could impact his work.

Its a pretty similar from what @michaelpporter (https://github.com/michaelpporter/ansible-role-certbot-cloudflare) did like 3 years ago.

Let me know what you think and how it will be more helpful. Would love to get some feedback!

Best regards,

@sgarwood Sure, i did a "wrapper" for this role on this following post. Documentation is on the following url: https://github.com/brunobenchimol/ansible-role-certbot-dns

I hope its well written so you can understand by reading it, if is not, let me know any questions or how i can improve it!

Best regards

sgarwood commented 2 years ago

My apologies I misunderstood the 'extends on top of' in your previous response- to me it seemed like you had forked and amended this original certbot role to include this functionality.

Thanks for the clarificiation. Describing it as a wrapper made complete sense to me.

Excellent work and really elegant solution. A great idea to work around the radio silence from the maintainer on this particular issue.

brunobenchimol commented 2 years ago

I think it will resolve #186

pyropy commented 2 years ago

Bump šŸ†™

sebdanielsson commented 1 year ago

Is this role unmaintained now or why the radio silence? Just tried it out but couldnā€™t find a way to use a DNS challenge.

bugspencor commented 1 year ago

Here is a blog post on @geerlingguy 's "maintenance policy": https://www.jeffgeerling.com/blog/2022/just-say-no

TL;DR It probably won't be merged. You can use @brunobenchimol 's fork (or maintain your own). Last time I used it it worked for me.

geerlingguy commented 1 year ago

Just to follow up on thatā€”this role is already a little more complex than some I maintain, and adding on DNS cert support almost doubles the complexity, and is also nearly impossible to end-to-end test via CI, unless I were willing to work with one of the providers to have a public access account.

I have considered DNS support for this role in the past (and could've used it on a couple projects), but every time it is just complex enough that I don't want to commit to maintaining it in my own role, since I would use it so infrequently.

sebdanielsson commented 1 year ago

As a student, employee, having a family plus trying to keep up with my own geeky stuff I can definitely relatešŸ‘ Have you considered:

  1. Bring in one or two volunteer maintainers for the more complex projects with lots of issues.
  2. Go through some issues and maybe mark them as "not planned" so we don't get our hopes up?šŸ˜‰
brunobenchimol commented 1 year ago

At first i did not understand why @geerlingguy did not reply to this PR and after a while reading other projects i quickly realized that it was very hard to maintain such large number of projects.

I am happy to help but i also do not have enough time (i could say i have very few projects on github and lesser public ones), than i came out with the idea of creating a "wrapper" for this role (feat. ansible great power of reuseability).

I've had a real hard time to get it tested end-to-end using github CI... i managed it for a while but its now failing. Too cumbersome to program and very hard to maintain to many platforms.

After that long time im very happy that it got some people looking for it and even Jeff replied to it.

Considering all that, i was pretty sure that it would not be merged... all i could ask for (if its reasonable, of course), is a link on README/documentation similar to Wildcard sections.

If its possible would be great, its such a great effort to maintain a complex role for public usage.

Best regards folks!