mirror of
https://github.com/rkivalin/certforge.git
synced 2026-10-12 16:00:45 +00:00
Roman KivalinandClaude Opus 4.6
b6d299300d
DNS-01 solvers now accept a propagation_delay option (default 5s). When multiple solvers are used for a certificate, the longest delay is used. The Solver trait method changes from needs_propagation_delay() returning bool to propagation_delay() returning Option<Duration>. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
130 lines
3.8 KiB
TOML
130 lines
3.8 KiB
TOML
# Certforge configuration
|
|
#
|
|
# This is a reference configuration. Uncomment and adjust the sections
|
|
# below to match your environment. No certificates will be managed
|
|
# until at least one [[certificate]] block is uncommented.
|
|
|
|
[acme]
|
|
directory_url = "https://acme-v02.api.letsencrypt.org/directory"
|
|
# Use staging for testing:
|
|
# directory_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
|
|
|
|
# ACME account key: stored as encrypted systemd credential
|
|
# account_key_credential = "/etc/credstore.encrypted/acme-account-key"
|
|
# Or as a plain file:
|
|
account_key_path = "/etc/certforge/account.key"
|
|
|
|
contact = ["mailto:admin@example.com"]
|
|
|
|
# Default solver for all certificates (can be overridden per-certificate)
|
|
# default_solver = "dns"
|
|
|
|
# DNS client connections — referenced by solvers and DANE blocks
|
|
[dns.main]
|
|
server = "ns1.example.com"
|
|
# Single zone:
|
|
zone = "example.com"
|
|
# Multiple zones on the same server (longest suffix match):
|
|
# zones = ["example.com", "example.org"]
|
|
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-key"
|
|
tsig_key_path = "/etc/certforge/tsig.key"
|
|
tsig_key_name = "certforge."
|
|
tsig_algorithm = "hmac-sha256"
|
|
port = 53
|
|
protocol = "tcp"
|
|
|
|
# Additional DNS clients (e.g., different server or TSIG key)
|
|
# [dns.other]
|
|
# server = "ns2.example.org"
|
|
# zone = "example.org"
|
|
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-org"
|
|
# tsig_key_name = "certforge-org."
|
|
|
|
# Challenge solvers
|
|
[solver.dns]
|
|
type = "dns-01"
|
|
dns = "main" # references [dns.main]
|
|
# propagation_delay = 5 # seconds to wait for DNS propagation (default: 5)
|
|
|
|
# [solver.dns-org]
|
|
# type = "dns-01"
|
|
# dns = "org"
|
|
|
|
# [solver.http]
|
|
# type = "http-01"
|
|
# listen = "[::]:80" # single address
|
|
# # listen = ["[::]:80", "[::]:8080"] # multiple: try all, succeed if any binds
|
|
# # OR: webroot = "/var/www/acme"
|
|
|
|
# [solver.tls]
|
|
# type = "tls-alpn-01"
|
|
# listen = "[::]:443" # single or list like http-01
|
|
|
|
# Named hooks — run once after all renewals, deduplicated across certificates.
|
|
# Hooks run in the order defined here.
|
|
# [[hook]]
|
|
# name = "reload-postfix"
|
|
# type = "systemd-reload"
|
|
# unit = "postfix.service"
|
|
#
|
|
# [[hook]]
|
|
# name = "reload-nginx"
|
|
# type = "systemd-reload"
|
|
# unit = "nginx.service"
|
|
|
|
# Uncomment and configure certificate blocks below.
|
|
#
|
|
# [[certificate]]
|
|
# name = "mail"
|
|
# domains = ["mail.example.com"]
|
|
# solver = "dns"
|
|
# key_type = "ecdsa-p256" # ecdsa-p256, ecdsa-p384
|
|
# key_credential = "/etc/credstore.encrypted/mail-tls-key"
|
|
# # key_path = "/etc/certforge/keys/mail.key"
|
|
# cert_path = "/etc/certforge/certs/mail.pem"
|
|
# renew_before_days = 30
|
|
# rotate_key = false
|
|
# # Named hooks (deduplicated if multiple certs reference the same hook)
|
|
# hooks = ["reload-postfix"]
|
|
#
|
|
# # DANE TLSA for SMTP (port 25)
|
|
# [[certificate.dane]]
|
|
# dns = "main"
|
|
# usage = "ee"
|
|
# selector = "spki"
|
|
# matching = "sha256"
|
|
# names = ["_25._tcp.mail.example.com"]
|
|
# ttl = 300
|
|
# pre_publish = true
|
|
#
|
|
# # Inline hooks (always run per-certificate, not deduplicated)
|
|
# [[certificate.hook]]
|
|
# type = "systemd-reload"
|
|
# unit = "postfix.service"
|
|
#
|
|
# # IP address certificate (requires shortlived profile, ~6 day validity)
|
|
# [[certificate]]
|
|
# name = "dns-server"
|
|
# domains = ["dns.example.com", "203.0.113.1", "2001:db8::1"]
|
|
# solvers = ["dns", "http", "http"]
|
|
# profile = "shortlived"
|
|
# renew_before_days = 3
|
|
# key_path = "/etc/certforge/keys/dns-server.key"
|
|
# cert_path = "/etc/certforge/certs/dns-server.pem"
|
|
#
|
|
# # Simple certificate using default_solver
|
|
# [[certificate]]
|
|
# name = "web"
|
|
# domains = ["example.com", "www.example.com"]
|
|
# key_credential = "/etc/credstore.encrypted/web-tls-key"
|
|
# cert_path = "/etc/certforge/certs/web.pem"
|
|
#
|
|
# [[certificate.dane]]
|
|
# dns = "main"
|
|
# names = ["_443._tcp.example.com", "_443._tcp.www.example.com"]
|
|
# ttl = 3600
|
|
#
|
|
# [[certificate.hook]]
|
|
# type = "systemd-reload"
|
|
# unit = "nginx.service"
|