rc/servers
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ceph: add LE certificates

Browse source 
With a hook to restart RGW services on renewal, if there are any. Live
certificates are linked to the same path under /etc/ceph on each host,
so that the orch service spec is node-independent.

Use with something like this (port 80 must be kept free for standalone
certbot renewal):

    service_type: rgw
    spec:
      rgw_frontend_port: 8080
      rgw_frontend_extra_args:
        - ssl_port=443
        - ssl_private_key=/etc/ceph/privkey.pem
        - ssl_certificate=/etc/ceph/fullchain.pem
    extra_container_args:
      - "--volume"
      - "/etc/ceph:/etc/ceph:ro"
      - "--volume"
      - "/etc/letsencrypt:/etc/letsencrypt:ro"
This commit is contained in:
Timotej Lazar 2024-11-08 16:32:06 +01:00
parent 6e5de53937
commit 46a9ff6fc0
4 changed files with 41 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
roles/ceph/tasks/main.yml
View file

@ -39,3 +39,5 @@
mode: 0755
- include_tasks: firewall.yml
- include_tasks: cert.yml