view release on metacpan or  search on metacpan

acmeman  view on Meta::CPAN

domain B<example.com>, using B<www.example.com> as its alternative name,
The B<files> statement identifies the name of a B<files> section containing
rules for creating certificate files for that domain. This section must be
defined elsewhere in the configuration file. For example:

    [files default]
	type = split
	certificate-file = /etc/ssl/acme/$domain/cert.pem
	key-file = /etc/ssl/acme/$domain/privkey.pem
	ca-file = /etc/ssl/acme/$domain/ca.pem
	argument = $domain

This definition tells B<acmeman> that it should store certificate, certificate
key, and certificate authority chain in three separate files. Names of these
files will be created by replacing the B<$domain> string in the corresponding
definition with the domain name from the B<domain> section.

Several B<[domain]> section can share the same B<[files]> definition, or
they can have their one, depending on your needs.

=head1 CONFIGURATION

Configuration file controls the operation of B<acmeman>. By default,
its name is B</etc/acmeman.conf>. If it is absent, B<acmeman> falls
back to the legacy operation mode, scanning Apache configuration files
for domains that use LetsEncrypt SSL certificates. See the B<APACHE>
section below for a detailed description.

The configuration file has a traditional line-oriented syntax. Comments
are introduced with a hash sign. Empty lines are ignored. Leading and
trailing whitespace is removed prior to parsing. Long statements can be
split over several physical lines by ending each line excepting the last
one with a backslash immediately followed by a newline character.

Configuration consists of settings grouped into sections.  Syntactically,
a I<setting> is

    KEYWORD = VALUE

where I<KEYWORD> stands for a symbolic name consisting of alphanumeric
characters, dashes and underscores, and I<VALUE> stands for any sequence
of characters.

A I<section> is identified by its name and optional arguments. It begins
with the following construct:

    [NAME]

or, if arguments are present:

    [NAME ARG1 ARG2 ...]

The square brackets are part of the syntax.

A section can contain one or more settings.

The statements in the configuration file form a directed graph. Often
in this document we will identify the statement by its I<path>, i.e. a
list of section name, its arguments, and the keyword, separated by dots. For
example, the path B<files.apache.type> corresponds to the following
configuration file fragment:

    [files apache]
       type = single


The following describes the available sections and keywords

=head2 B<[core]>

This section defines the behavior of the program as a whole.

=over 4

=item B<rootdir=>I<DIR>

Defines the root directory to use instead of the default </var/www/acme>.
Root directory is the directory under which the
F<.well-known/acme-challenge> subdirectory is located.

=item B<time-delta=>I<SECONDS>

Sets the time window before the actual expiration time, when the certificate
becomes eligible for renewal.  I<N> is time in seconds.  The default
value is 86400, which means that B<acmeman> will attempt to renew any
certificate that expires within 24 hours.

The command line option B<--time-delta> overrides this setting.

=item B<postrenew=>I<COMMAND>

Defines the command to be run at the end of the run if at least one
certificate has been updated. Normally this command reloads the httpd
server (or whatever server is using the certificates). If more than one
B<postrenew> statements are defined, they will be run in sequence, in the
same order as they appeared in the configuration file.

I<COMMAND> inherits the environment from the B<acmeman> process, with the
following additional variables:

=over 8

=item ACMEMAN_CERTIFICATE_COUNT

Total count of renewed certificate files.

=item ACMEMAN_CERTIFICATE_FILE

Whitespace-delimited list of renewed certificate files

=item ACMEMAN_DOMAIN_NAME

Whitespace-delimited list of renewed domain names (CNs).

=item ACMEMAN_ALT_NAMES

Whitespace-delimited list of alternative DNS names from the renewed
certificate files.

=back