GitHub puppet-letsencrypt

A Puppet module to install the Letsencrypt client and request certificates.

<!--
Thank you for contributing to this project!

• This project has a Contributor Code of Conduct: https://voxpupuli.org/coc/
• Please check that here is no existing issue or PR that addresses your problem.
• Our vulnerabilities reporting process is at https://voxpupuli.org/security/

-->

Pull Request (PR) description

On FreeBSD and OpenBSD gid 0 is 'wheel', not 'root' and it will fail.
Using gid 0 corrects this simply.

This Pull Request (PR) fixes the following issues

I didn't find an issue for this, but the PR #231 is similar.

Add new optional parameter to set the group ownership of shipped files

Some Operating Systems (a current OpenBSD release) don't have group 'root' - this PR allows setting the group to something else.
Default of group:root has not changed

This Pull Request (PR) fixes the following issues

N/A

Pull Request (PR) description

Allow specifying which key type to generate. Certbot changed it's default from rsa to elliptic curve, but I kept the default to rsa for backwards compatibility.

<!--
Thank you for contributing to this project!

• This project has a Contributor Code of Conduct: https://voxpupuli.org/coc/
• Please check that here is no existing issue or PR that addresses your problem.
• Our vulnerabilities reporting process is at https://voxpupuli.org/security/

-->

Pull Request (PR) description

Add dns-ovh support based on dns_rfc2136 implementation

Fixes #63.
We rename the environment to venv_vars in order to ensure that hiera calls do not break, as soon as a puppet execution flow enters our module. For consistency's sake, we change environment not only in the main class (where it's definitely needed: rodjek/puppet-lint#574), but also in the certonly define.

Pull Request (PR) description

Change the random seed per hour for letsencrypt::certonly cronjob resource.

This Pull Request (PR) fixes the following issues

Fixes #47

Pull Request (PR) description

This PR aims at removing the system cron or systemd timer when the renew cron is managed by puppet (this doesn't handle certonly cron). If we don't do that on certains distro (for exemple Debian), a cron will be automaticaly added by the package and might renew the certificate before the puppet cron, and thus the puppet renew hooks won't be executed.

This Pull Request (PR) fixes the following issues

Fixes #164

modulesync 5.4.0

Pull Request (PR) description

Add dns-azure to list of allowed plugins.

This is one of the 3rd party plugins listed at https://eff-certbot.readthedocs.io/en/stable/using.html#third-party-plugins

Caveat

I'm currently using this module on my branch on a RHEL 9 host, but the only caveat is the fastest way I found to get the plugin working was via the snap package:

```puppet
include snap

package { 'certbot':
ensure => installed,
provider => 'snap',
install_options => ['classic'],
}

file { '/usr/bin/certbot':
ensure => link,
source => '/snap/bin/certbot',
require => Package['certbot'],
}

package { 'certbot-dns-azure':
ensure => installed,
provider => 'snap',
install_options => ['channel=edge'],
require => Package['certbot'],
}
```

And also had to run snap set certbot trust-plugin-with-root=ok before the last package resource, but didn't take the time yet to examine what changed on disk in order to create an exec resource to do that.

<!--
Thank you for contributing to this project!

• This project has a Contributor Code of Conduct: https://voxpupuli.org/coc/
• Please check that here is no existing issue or PR that addresses your problem.
• Our vulnerabilities reporting process is at https://voxpupuli.org/security/

-->

Pull Request (PR) description

This PR makes sure that only single certificate can be processed at the same time. Make sure to obtain exclusive lock before executing renewal command.

flock command is used to obtain exclusive lock (with 30 seconds timeout).

This Pull Request (PR) fixes the following issues

Resolve errors like this, when randomized cron job time is not enough:

Another instance of Certbot is already running.


Pull Request (PR) description

My apologies on missing this. In testing https://github.com/voxpupuli/puppet-letsencrypt/pull/254 I had manually enable the python36 module stream at some point before hand, but after running on a fresh install I realized certbot requires this module stream to be enabled per:

Error: Execution of '/bin/dnf -d 0 -e 1 -y install certbot' returned 1: Error:
Problem: package certbot-1.20.0-1.el8.noarch requires python3-certbot = 1.20.0-1.el8, but none of the providers can be installed
- package python3-certbot-1.20.0-1.el8.noarch requires /usr/bin/python3.6, but none of the providers can be installed
- conflicting requests
- package python36-3.6.8-2.module_el8.3.0+6191+6b4b10ec.x86_64 is filtered out by modular filtering
Error: /Stage[main]/Letsencrypt::Install/Package[letsencrypt]/ensure: change from 'purged' to 'present' failed: Execution of '/bin/dnf -d 0 -e 1 -y install certbot' returned 1: Error:
Problem: package certbot-1.20.0-1.el8.noarch requires python3-certbot = 1.20.0-1.el8, but none of the providers can be installed
- package python3-certbot-1.20.0-1.el8.noarch requires /usr/bin/python3.6, but none of the providers can be installed
- conflicting requests
- package python36-3.6.8-2.module_el8.3.0+6191+6b4b10ec.x86_64 is filtered out by modular filtering


This Pull Request (PR) fixes the following issues

Fixes #236

<!--
Thank you for contributing to this project!

• This project has a Contributor Code of Conduct: https://voxpupuli.org/coc/
• Please check that here is no existing issue or PR that addresses your problem.
• Our vulnerabilities reporting process is at https://voxpupuli.org/security/

-->

Pull Request (PR) description

Adding feature support for the certbot-plugin-gandi created by @obynio

The plugin use the Production API key.

This Pull Request (PR) fixes the following issues

<!--
Replace this comment with the list of issues or n/a.
Use format:
Fixes #123
Fixes #124
-->
N/A