lego, The ACME Client, Every DNS Provider Listed
lego on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then runs the pinned binary and has dnshelp list the DNS-01 providers it can drive (route53, cloudflare, azuredns, gcloud among some two hundred). v5 command tree documented. Pinned. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-21 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
lego
go-acme lego on EL 10 from the vendor's release, checked against the
published SHA-256, pinned to a version, installed as root's binary
in /usr/local/bin. Original role for EL 10, live-tested with podman on
Rocky Linux 10.
No package worth the name. EL 10 carries no lego, and a
third-party repository is one more key to trust. This role takes the
release from go-acme.github.io/lego, has Ansible's get_url refuse the asset unless
its SHA-256 is the published one, and the live test checks the asset on
disk against the same published value again.
Pinned. lego_version is what gets installed, kept in a directory
of its own so the checksum file and the asset it names stay together. A
newer release is a variable change and a run; the same version is
changed=0.
Proven to run. The live test runs lego dnshelp -c route53 and expects
"Configuration for Amazon Route 53" - the binary ran all the way to the point where it
needed something this host does not have.
The ACME client, without an ACME server. Issuing a certificate
needs a CA and a domain the lane does not have, so the live test proves
the parts that are offline: the pinned version answers, and lego dnshelp lists every DNS provider lego can complete a DNS-01 challenge
through (route53, cloudflare, azuredns, gcloud and some two hundred
more are asserted present). The v5 command tree differs from v4: there
is no --path global and no list; certificates are lego certificates list --path <dir>, accounts lego accounts list. The checksum file
carries no v in its name while the asset does; both are in the
defaults.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
vault-kv-engine
KV v1 overwrites in place, so a bad write is the end of the previous secret; cas_required defaults to false, so two writers that read the same version both succeed and the second silently replaces the first; and version history is unbounded by default. v2 always, check-and-set on (off by name), versions bounded by count and age, the mount's lease ceilings set rather than inherited.
vault-pki-certificate-authority
Issuing from the root puts every leaf one signature from the root's compromise; a PKI role's defaults issue nothing until somebody reaches for allow_any_name, which issues for every hostname; and without AIA and CRL URLs a leaf is valid and unverifiable. A root that signs one intermediate, roles bound to allowed_domains, 30-day leaves under a 90-day ceiling, URLs on both mounts.
vault-approle
A secret ID with no TTL and no use limit is a password, and both default to unlimited; a role with no bound CIDRs logs in from anywhere; and a role with no max TTL mints tokens that renew forever. Secret IDs that live an hour and are used once, roles bound to the ranges they run from with unbound accepted by name, and token ceilings set.
ansible-cfssl
cfssl and cfssljson on EL 10 from the GitHub release, each refused by Ansible's get_url unless its SHA-256 is the one in the vendor's checksums file, and re-checked by the live test, which mints a root CA from a CSR, writes it as PEM through cfssljson and reads the subject back with certinfo. Pinned; a newer release is a variable change. Original role, live-tested on Rocky Linux 10.
vault-database-secrets
The credential Vault connects with is still a password somebody knows until Vault rotates it; a role with no max TTL issues credentials that renew forever; and creation statements are the privilege, so a careless one is a superuser factory. Root rotation daily, TTLs per role, statements that grant exactly the PostgreSQL role you name, and the connection verified at apply.
vault-oidc-auth
An OIDC role with no bound claims admits every user of the identity provider; a role with no bound audience accepts tokens minted for other services; and the client secret lands in state. Bound claims expected with none accepted by name, an audience required, callbacks listed rather than assumed, token ceilings set, and the write-only secret path named for Terraform 1.11+.