mirror of
https://github.com/rkivalin/certforge.git
synced 2026-10-12 16:00:45 +00:00
Roman KivalinandClaude Opus 4.6
c717da348a
Support key_mode, key_owner, key_group and cert_mode, cert_owner, cert_group per certificate. Mode is an octal string (e.g. "0640"), owner/group are resolved by name via getpwnam/getgrnam. Permissions are checked before applying — system calls are only made when the current state differs from the desired state, and changes are logged. Runs on every renew for existing files, not just when certificates are renewed. Defaults: key 0600, cert 0644, owner/group unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
136 lines
4.1 KiB
TOML
136 lines
4.1 KiB
TOML
# Certforge configuration
|
|
#
|
|
# This is a reference configuration. Uncomment and adjust the sections
|
|
# below to match your environment. No certificates will be managed
|
|
# until at least one [[certificate]] block is uncommented.
|
|
|
|
[acme]
|
|
directory_url = "https://acme-v02.api.letsencrypt.org/directory"
|
|
# Use staging for testing:
|
|
# directory_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
|
|
|
|
# ACME account key: stored as encrypted systemd credential
|
|
# account_key_credential = "/etc/credstore.encrypted/acme-account-key"
|
|
# Or as a plain file:
|
|
account_key_path = "/etc/certforge/account.key"
|
|
|
|
contact = ["mailto:admin@example.com"]
|
|
|
|
# Default solver for all certificates (can be overridden per-certificate)
|
|
# default_solver = "dns"
|
|
|
|
# DNS client connections — referenced by solvers and DANE blocks
|
|
[dns.main]
|
|
server = "ns1.example.com"
|
|
# Single zone:
|
|
zone = "example.com"
|
|
# Multiple zones on the same server (longest suffix match):
|
|
# zones = ["example.com", "example.org"]
|
|
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-key"
|
|
tsig_key_path = "/etc/certforge/tsig.key"
|
|
tsig_key_name = "certforge."
|
|
tsig_algorithm = "hmac-sha256"
|
|
port = 53
|
|
protocol = "tcp"
|
|
|
|
# Additional DNS clients (e.g., different server or TSIG key)
|
|
# [dns.other]
|
|
# server = "ns2.example.org"
|
|
# zone = "example.org"
|
|
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-org"
|
|
# tsig_key_name = "certforge-org."
|
|
|
|
# Challenge solvers
|
|
[solver.dns]
|
|
type = "dns-01"
|
|
dns = "main" # references [dns.main]
|
|
# propagation_delay = 5 # seconds to wait for DNS propagation (default: 5)
|
|
|
|
# [solver.dns-org]
|
|
# type = "dns-01"
|
|
# dns = "org"
|
|
|
|
# [solver.http]
|
|
# type = "http-01"
|
|
# listen = "[::]:80" # single address
|
|
# # listen = ["[::]:80", "[::]:8080"] # multiple: try all, succeed if any binds
|
|
# # OR: webroot = "/var/www/acme"
|
|
|
|
# [solver.tls]
|
|
# type = "tls-alpn-01"
|
|
# listen = "[::]:443" # single or list like http-01
|
|
|
|
# Named hooks — run once after all renewals, deduplicated across certificates.
|
|
# Hooks run in the order defined here.
|
|
# [[hook]]
|
|
# name = "reload-postfix"
|
|
# type = "systemd-reload"
|
|
# unit = "postfix.service"
|
|
#
|
|
# [[hook]]
|
|
# name = "reload-nginx"
|
|
# type = "systemd-reload"
|
|
# unit = "nginx.service"
|
|
|
|
# Uncomment and configure certificate blocks below.
|
|
#
|
|
# [[certificate]]
|
|
# name = "mail"
|
|
# domains = ["mail.example.com"]
|
|
# solver = "dns"
|
|
# key_type = "ecdsa-p256" # ecdsa-p256, ecdsa-p384
|
|
# key_credential = "/etc/credstore.encrypted/mail-tls-key"
|
|
# # key_path = "/etc/certforge/keys/mail.key"
|
|
# # key_mode = "0640" # file mode (default: 0600)
|
|
# # key_owner = "root" # file owner (default: unchanged)
|
|
# # key_group = "postfix" # file group (default: unchanged)
|
|
# cert_path = "/etc/certforge/certs/mail.pem"
|
|
# # cert_mode = "0644" # file mode (default: 0644)
|
|
# # cert_owner = "root"
|
|
# # cert_group = "postfix"
|
|
# renew_before_days = 30
|
|
# rotate_key = false
|
|
# # Named hooks (deduplicated if multiple certs reference the same hook)
|
|
# hooks = ["reload-postfix"]
|
|
#
|
|
# # DANE TLSA for SMTP (port 25)
|
|
# [[certificate.dane]]
|
|
# dns = "main"
|
|
# usage = "ee"
|
|
# selector = "spki"
|
|
# matching = "sha256"
|
|
# names = ["_25._tcp.mail.example.com"]
|
|
# ttl = 300
|
|
# pre_publish = true
|
|
#
|
|
# # Inline hooks (always run per-certificate, not deduplicated)
|
|
# [[certificate.hook]]
|
|
# type = "systemd-reload"
|
|
# unit = "postfix.service"
|
|
#
|
|
# # IP address certificate (requires shortlived profile, ~6 day validity)
|
|
# [[certificate]]
|
|
# name = "dns-server"
|
|
# domains = ["dns.example.com", "203.0.113.1", "2001:db8::1"]
|
|
# solvers = ["dns", "http", "http"]
|
|
# profile = "shortlived"
|
|
# renew_before_days = 3
|
|
# key_path = "/etc/certforge/keys/dns-server.key"
|
|
# cert_path = "/etc/certforge/certs/dns-server.pem"
|
|
#
|
|
# # Simple certificate using default_solver
|
|
# [[certificate]]
|
|
# name = "web"
|
|
# domains = ["example.com", "www.example.com"]
|
|
# key_credential = "/etc/credstore.encrypted/web-tls-key"
|
|
# cert_path = "/etc/certforge/certs/web.pem"
|
|
#
|
|
# [[certificate.dane]]
|
|
# dns = "main"
|
|
# names = ["_443._tcp.example.com", "_443._tcp.www.example.com"]
|
|
# ttl = 3600
|
|
#
|
|
# [[certificate.hook]]
|
|
# type = "systemd-reload"
|
|
# unit = "nginx.service"
|