Configure Apache with SSL and acme.sh for one or more websites per host, optionally as reverse proxy.

Websites are defined as dict in host_vars / group_vars (or passed via include_role vars). The key is the domain (ServerName and certificate name). Without websites the host serves one website named after inventory_hostname.

Before a certificate is requested, a token is placed in <docroot>/.well-known/acme-challenge/ and fetched via http://<domain>/.... If the domain does not reach this host, certificate and ssl vhost are skipped (warning at the end of the role) and retried on the next run.

Example

websites:
  example.digital-infinity.de:            # static site
    aliases: www.example.digital-infinity.de
    docroot: /var/www/example
    extra_directives: |
      Header always set Strict-Transport-Security "max-age=31536000"      

  app.digital-infinity.de:                # reverse proxy, only the target url is required
    proxy_pass: http://127.0.0.1:8080/

  immich:
    proxy_pass: http://127.0.0.1:2283/
    proxy_websocket: true
    proxy_timeout: 600

  old.digital-infinity.de:
    state: absent                         # removes vhosts and stops renewal, keeps cert files

Options per website

option	default
state	present	absent removes the vhosts
aliases	[]	ServerAlias, string or list (not part of the certificate)
docroot	/var/www/html	also used as acme webroot
use_local_ca	use_local_ca / false	true -> internal acme_sh_server instead of letsencrypt (for internal sites)
check_dns	true	reachability check before requesting a certificate
extra_directives	""	raw apache directives inside the ssl vhost
proxy_pass	""	target url, enables the reverse proxy
proxy_path	/
proxy_preserve_host	true	ProxyPreserveHost
proxy_forwarded_headers	true	X-Forwarded-Proto/-Port
proxy_websocket	false	adds upgrade=websocket (apache >= 2.4.47)
proxy_timeout	""	timeout= in seconds
proxy_ssl_verify	true	false disables certificate checks for https backends
proxy_options	""	further ProxyPass options, e.g. nocanon

Global variables

• website_check_host (default inventory_hostname): host running the reachability check, e.g. localhost to check from the controller
• website_check_timeout (default 10)
• website_fail_without_cert (default false): fail instead of warn if a domain is not reachable
• website_site_defaults: defaults for all websites