310 lines
12 KiB
Plaintext
310 lines
12 KiB
Plaintext
# ╔═══════════════════════════════════════════════════════════╗
|
|
# ║ CertPusher Configuration File ║
|
|
# ║ SSL Certificate Distribution Configuration ║
|
|
# ╚═══════════════════════════════════════════════════════════╝
|
|
|
|
[global]
|
|
# Global source certificate and private key
|
|
source_cert_path = /etc/letsencrypt/live/example.com/fullchain.pem
|
|
source_key_path = /etc/letsencrypt/live/example.com/privkey.pem
|
|
|
|
# Default SSH key for all hosts (can be overridden per host)
|
|
default_ssh_key = /root/.ssh/id_rsa
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# MIKROTIK DEVICES
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[mikrotik_router]
|
|
type = mikrotik
|
|
hostname = 172.16.0.1
|
|
port = 51022
|
|
username = admin
|
|
ssh_key_path = /root/.ssh/id_rsa_proxy
|
|
# Check certificate before upload (default: true)
|
|
check_before_upload = true
|
|
mikrotik_services = www-ssl,api-ssl
|
|
|
|
|
|
[mikrotik_switch]
|
|
type = mikrotik
|
|
hostname = 192.168.1.50
|
|
port = 22
|
|
username = admin
|
|
# Always upload without checking
|
|
check_before_upload = false
|
|
mikrotik_services = www-ssl,api-ssl
|
|
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# PROXMOX VE SERVERS
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[proxmox1]
|
|
type = proxmox
|
|
hostname = 10.87.2.150
|
|
port = 11922
|
|
username = root
|
|
check_url = https://10.87.2.150:8006
|
|
check_before_upload = true
|
|
|
|
[proxmox2]
|
|
type = proxmox
|
|
hostname = 10.87.2.151
|
|
port = 11922
|
|
username = root
|
|
check_url = https://10.87.2.151:8006
|
|
check_before_upload = true
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# HOME ASSISTANT INSTALLATIONS
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[homeassistant_supervised]
|
|
type = standard
|
|
hostname = 192.168.1.100
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /usr/share/hassio/ssl/fullchain.pem
|
|
remote_key_path = /usr/share/hassio/ssl/privkey.pem
|
|
post_upload_command = ha core restart
|
|
check_url = https://homeassistant.local:8123
|
|
|
|
[homeassistant_core]
|
|
type = standard
|
|
hostname = 192.168.1.101
|
|
port = 22
|
|
username = homeassistant
|
|
ssh_key_path = /root/.ssh/homeassistant_key
|
|
remote_cert_path = /home/homeassistant/.homeassistant/fullchain.pem
|
|
remote_key_path = /home/homeassistant/.homeassistant/privkey.pem
|
|
post_upload_command = sudo systemctl restart home-assistant@homeassistant
|
|
check_url = https://192.168.1.101:8123
|
|
|
|
[homeassistant_docker]
|
|
type = standard
|
|
hostname = 192.168.1.102
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /opt/homeassistant/config/fullchain.pem
|
|
remote_key_path = /opt/homeassistant/config/privkey.pem
|
|
post_upload_command = docker restart homeassistant
|
|
check_url = https://ha.example.com:8123
|
|
|
|
[homeassistant_haos]
|
|
type = standard
|
|
hostname = 192.168.1.103
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /ssl/fullchain.pem
|
|
remote_key_path = /ssl/privkey.pem
|
|
post_upload_command = ha core restart
|
|
check_url = https://192.168.1.103:8123
|
|
|
|
[homeassistant_nginx_proxy]
|
|
type = standard
|
|
hostname = 192.168.1.104
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /etc/nginx/ssl/homeassistant/fullchain.pem
|
|
remote_key_path = /etc/nginx/ssl/homeassistant/privkey.pem
|
|
post_upload_command = nginx -t && systemctl reload nginx
|
|
check_url = https://ha.example.com
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# WEB SERVERS (NGINX & APACHE)
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[webserver_nginx]
|
|
type = standard
|
|
hostname = 192.168.1.110
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /etc/nginx/ssl/fullchain.pem
|
|
remote_key_path = /etc/nginx/ssl/privkey.pem
|
|
post_upload_command = nginx -t && systemctl reload nginx
|
|
check_url = https://example.com
|
|
|
|
[webserver_apache]
|
|
type = standard
|
|
hostname = 192.168.1.111
|
|
port = 2222
|
|
username = admin
|
|
ssh_key_path = /root/.ssh/webserver_key
|
|
remote_cert_path = /etc/apache2/ssl/fullchain.pem
|
|
remote_key_path = /etc/apache2/ssl/privkey.pem
|
|
post_upload_command = apachectl configtest && systemctl reload apache2
|
|
check_url = https://subdomain.example.com
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# MAIL SERVERS (POSTFIX/DOVECOT)
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[mailserver_postfix]
|
|
type = standard
|
|
hostname = mail.example.com
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /etc/postfix/ssl/cert.pem
|
|
remote_key_path = /etc/postfix/ssl/privkey.pem
|
|
post_upload_command = systemctl restart postfix && systemctl restart dovecot
|
|
check_url = https://mail.example.com:587
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# DOCKER / CONTAINER PLATFORMS
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[docker_traefik]
|
|
type = standard
|
|
hostname = 10.0.0.60
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /opt/docker/traefik/certs/fullchain.pem
|
|
remote_key_path = /opt/docker/traefik/certs/privkey.pem
|
|
post_upload_command = docker restart traefik
|
|
check_url = https://traefik.example.com
|
|
|
|
[docker_nginx_proxy_manager]
|
|
type = standard
|
|
hostname = 10.0.0.61
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /opt/docker/npm/ssl/fullchain.pem
|
|
remote_key_path = /opt/docker/npm/ssl/privkey.pem
|
|
post_upload_command = docker exec nginx-proxy-manager nginx -s reload
|
|
check_url = https://npm.example.com
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# STORAGE / NAS DEVICES
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[truenas_scale]
|
|
type = standard
|
|
hostname = 10.0.0.70
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /etc/certificates/truenas_cert.crt
|
|
remote_key_path = /etc/certificates/truenas_cert.key
|
|
post_upload_command = midclt call system.general.ui_restart
|
|
check_url = https://truenas.local
|
|
|
|
[synology_nas]
|
|
type = standard
|
|
hostname = 10.0.0.71
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /usr/syno/etc/certificate/system/default/fullchain.pem
|
|
remote_key_path = /usr/syno/etc/certificate/system/default/privkey.pem
|
|
post_upload_command = /usr/syno/sbin/synoservicectl --reload nginx
|
|
check_url = https://synology.local:5001
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# HOSTS WITH CUSTOM CERTIFICATES
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[mailserver_custom_domain]
|
|
type = standard
|
|
hostname = mail.company.com
|
|
port = 22
|
|
username = root
|
|
# Override global certificate with domain-specific cert
|
|
source_cert_path = /etc/letsencrypt/live/mail.company.com/fullchain.pem
|
|
source_key_path = /etc/letsencrypt/live/mail.company.com/privkey.pem
|
|
remote_cert_path = /etc/postfix/ssl/cert.pem
|
|
remote_key_path = /etc/postfix/ssl/privkey.pem
|
|
post_upload_command = systemctl restart postfix && systemctl restart dovecot
|
|
check_url = https://mail.company.com:465
|
|
|
|
[api_server_subdomain]
|
|
type = standard
|
|
hostname = 192.168.1.200
|
|
port = 22
|
|
username = ubuntu
|
|
ssh_key_path = /root/.ssh/api_key
|
|
# API server with its own certificate
|
|
source_cert_path = /etc/letsencrypt/live/api.subdomain.org/fullchain.pem
|
|
source_key_path = /etc/letsencrypt/live/api.subdomain.org/privkey.pem
|
|
remote_cert_path = /etc/nginx/ssl/api/fullchain.pem
|
|
remote_key_path = /etc/nginx/ssl/api/privkey.pem
|
|
post_upload_command = systemctl reload nginx
|
|
check_url = https://api.subdomain.org
|
|
|
|
[client_website]
|
|
type = standard
|
|
hostname = 203.0.113.50
|
|
port = 2222
|
|
username = admin
|
|
# Client's own domain and certificate
|
|
source_cert_path = /etc/letsencrypt/live/client-domain.com/fullchain.pem
|
|
source_key_path = /etc/letsencrypt/live/client-domain.com/privkey.pem
|
|
remote_cert_path = /var/www/ssl/fullchain.pem
|
|
remote_key_path = /var/www/ssl/privkey.pem
|
|
post_upload_command = systemctl reload apache2
|
|
check_url = https://www.client-domain.com
|
|
|
|
[client_mikrotik]
|
|
type = mikrotik
|
|
hostname = 203.0.113.51
|
|
port = 22
|
|
username = admin
|
|
ssh_key_path = /root/.ssh/client_key
|
|
# Client's MikroTik with custom certificate
|
|
source_cert_path = /etc/letsencrypt/live/client-domain.com/fullchain.pem
|
|
source_key_path = /etc/letsencrypt/live/client-domain.com/privkey.pem
|
|
check_before_upload = true
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# DEVELOPMENT / STAGING SERVERS
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[dev_server]
|
|
type = standard
|
|
hostname = dev.local
|
|
port = 22
|
|
username = developer
|
|
# Dev server with staging certificate
|
|
source_cert_path = /etc/letsencrypt-staging/live/dev.example.com/fullchain.pem
|
|
source_key_path = /etc/letsencrypt-staging/live/dev.example.com/privkey.pem
|
|
remote_cert_path = /opt/app/ssl/fullchain.pem
|
|
remote_key_path = /opt/app/ssl/privkey.pem
|
|
post_upload_command = docker-compose restart nginx
|
|
# No check_url - always upload to dev environment
|
|
|
|
# ═══════════════════════════════════════════════════════════
|
|
# ADVANCED EXAMPLES
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
[nginx_with_chain]
|
|
type = standard
|
|
hostname = 192.168.1.120
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /etc/nginx/ssl/cert.pem
|
|
remote_key_path = /etc/nginx/ssl/private/key.pem
|
|
# Upload additional chain file
|
|
additional_files = /etc/letsencrypt/live/example.com/chain.pem:/etc/nginx/ssl/chain.pem
|
|
post_upload_command = nginx -t && systemctl reload nginx
|
|
check_url = https://example.com
|
|
|
|
[apache_separate_dirs]
|
|
type = standard
|
|
hostname = 192.168.1.121
|
|
port = 22
|
|
username = root
|
|
# Certificate and key in completely different directories
|
|
remote_cert_path = /etc/ssl/certs/apache-cert.pem
|
|
remote_key_path = /etc/ssl/private/apache-key.pem
|
|
post_upload_command = apachectl configtest && systemctl reload apache2
|
|
|
|
[multi_service_host]
|
|
type = standard
|
|
hostname = 192.168.1.130
|
|
port = 22
|
|
username = root
|
|
remote_cert_path = /etc/ssl/certs/fullchain.pem
|
|
remote_key_path = /etc/ssl/private/privkey.pem
|
|
# Deploy cert to multiple services
|
|
additional_files = /etc/letsencrypt/live/example.com/fullchain.pem:/opt/app1/ssl/cert.pem,/etc/letsencrypt/live/example.com/privkey.pem:/opt/app1/ssl/key.pem,/etc/letsencrypt/live/example.com/fullchain.pem:/opt/app2/ssl/cert.pem
|
|
post_upload_command = systemctl reload nginx && systemctl restart app1 && systemctl restart app2
|
|
check_url = https://example.com
|