mirror of
https://github.com/rkivalin/certforge.git
synced 2026-10-13 00:00:42 +00:00
Roman KivalinandClaude Opus 4.6
1c517ecbab
- MIT license - Arch Linux PKGBUILD - Debian packaging (debian/) - GitHub Actions: CI (test + clippy) and release workflow builds x86_64 + aarch64 binaries, Arch and Debian packages - Default config is now no-op (certificate blocks commented out) - Fix clippy warnings (collapsible ifs, redundant closures) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
77 lines
2.1 KiB
TOML
77 lines
2.1 KiB
TOML
# Certforge configuration
|
|
#
|
|
# This is a reference configuration. Uncomment and adjust the sections
|
|
# below to match your environment. No certificates will be managed
|
|
# until at least one [[certificate]] block is uncommented.
|
|
|
|
[acme]
|
|
directory_url = "https://acme-v02.api.letsencrypt.org/directory"
|
|
# Use staging for testing:
|
|
# directory_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
|
|
|
|
# ACME account key: stored as encrypted systemd credential
|
|
# account_key_credential = "/etc/credstore.encrypted/acme-account-key"
|
|
# Or as a plain file:
|
|
account_key_path = "/etc/certforge/account.key"
|
|
|
|
contact = ["mailto:admin@example.com"]
|
|
|
|
# Default DNS server for RFC 2136 updates
|
|
[dns.defaults]
|
|
server = "ns1.example.com"
|
|
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-key"
|
|
tsig_key_path = "/etc/certforge/tsig.key"
|
|
tsig_key_name = "certforge."
|
|
tsig_algorithm = "hmac-sha256"
|
|
port = 53
|
|
protocol = "tcp"
|
|
|
|
# Per-zone DNS overrides (optional)
|
|
# [dns.zones."example.org"]
|
|
# server = "ns2.example.org"
|
|
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-org"
|
|
|
|
# Uncomment and configure certificate blocks below.
|
|
#
|
|
# [[certificate]]
|
|
# name = "mail"
|
|
# domains = ["mail.example.com"]
|
|
# key_type = "ecdsa-p256"
|
|
# key_credential = "/etc/credstore.encrypted/mail-tls-key"
|
|
# # key_path = "/etc/certforge/keys/mail.key"
|
|
# cert_path = "/etc/certforge/certs/mail.pem"
|
|
# renew_before_days = 30
|
|
# rotate_key = false
|
|
#
|
|
# # DANE TLSA for SMTP (port 25)
|
|
# [[certificate.dane]]
|
|
# usage = "ee"
|
|
# selector = "spki"
|
|
# matching = "sha256"
|
|
# names = ["_25._tcp.mail.example.com"]
|
|
# ttl = 300
|
|
# pre_publish = true
|
|
#
|
|
# [[certificate.hook]]
|
|
# type = "systemd-reload"
|
|
# unit = "postfix.service"
|
|
#
|
|
# [[certificate]]
|
|
# name = "web"
|
|
# domains = ["example.com", "www.example.com"]
|
|
# key_type = "ecdsa-p256"
|
|
# key_credential = "/etc/credstore.encrypted/web-tls-key"
|
|
# cert_path = "/etc/certforge/certs/web.pem"
|
|
# renew_before_days = 30
|
|
#
|
|
# [[certificate.dane]]
|
|
# usage = "ee"
|
|
# selector = "spki"
|
|
# matching = "sha256"
|
|
# names = ["_443._tcp.example.com", "_443._tcp.www.example.com"]
|
|
# ttl = 3600
|
|
#
|
|
# [[certificate.hook]]
|
|
# type = "systemd-reload"
|
|
# unit = "nginx.service"
|