Configure配置说明

DNS, domains, servers, and notifications YAML.DNS、域名、服务器、通知四份 YAML 怎么写。

dns-providers.yml · domains.yml · servers.yml · notify.yml

Four files under config/. Fill DNS keys first, then domains, then servers. Notify can wait.config/ 下四份文件。建议顺序：先 DNS 密钥，再域名，再服务器。通知可以后配。

DNS providersDNS 提供商

Create config/dns-providers.yml (not committed). Map provider IDs to acme.sh env vars.自行创建 config/dns-providers.yml（不要提交）。把提供商 ID 映射成 acme.sh 需要的环境变量。

dns-providers.yml

# Aliyun
dns_providers:
  aliyun:
    provider_name: "阿里云DNS"
    acme_dns_type: dns_ali
    env_vars:
      Ali_Key: "你的 AccessKey"
      Ali_Secret: "你的 Secret"

  tencent:
    provider_name: "腾讯云DNS"
    acme_dns_type: dns_dp
    env_vars:
      DP_Id: "你的 Id"
      DP_Key: "你的 Key"

  huawei:
    provider_name: "华为云DNS"
    acme_dns_type: dns_huaweicloud
    env_vars:
      HUAWEICLOUD_Username: "..."
      HUAWEICLOUD_Password: "..."

permission权限 API keys only need DNS record write on the zones you manage — not full cloud admin. API 密钥只需对应域名的 DNS 解析写权限，不必开成全账号管理员。

Domains域名

Copy from domains.yml.example. Prefer wildcard when you have many subdomains. Mark console-upload-only hosts as manual.从 domains.yml.example 复制。子域名多时优先泛域名。只能控制台上传的标成 manual。

domains.yml

domains:
  - domain: example.com
    wildcard: true
    dns_provider: aliyun
    cert_type: wildcard
    auto_renew: true
    renew_before_days: 30
    servers:
      - server_prod_01
    subdomains:
      - domain: api.example.com
        deploy_method: auto
        deploy_dir: example.com
        cert_filename: fullchain.cer
        key_filename: example.com.key
      - domain: cdn.static.example.com
        deploy_method: manual   # CDN upload by hand

deploy_dir / filenames must match your nginx ssl paths.deploy_dir 和文件名必须和 nginx 的 ssl 路径一致。
dns_provider must equal an ID in dns-providers.yml.dns_provider 必须等于 dns-providers.yml 里的 ID。
servers lists IDs from servers.yml.servers 填 servers.yml 里的服务器 ID。

Servers服务器

servers.yml

servers:
  - server_id: server_prod_01
    host: 192.168.1.100
    port: 22
    user: root
    ssh_key_path: ~/.ssh/id_rsa
    ssl_cert_dir: /opt/docker/nginx/ssl
    nginx_reload_cmd: docker restart nginx
    backup_dir: /opt/docker/nginx/ssl/backups

Docker nginx: reload often restarts the container; point ssl_cert_dir at the host mount, not a path that only exists inside a throwaway container FS.Docker 版 nginx：reload 常用重启容器；ssl_cert_dir 请指向宿主机挂载目录，不要写只存在于临时容器文件系统里的路径。
System nginx example: nginx -t && nginx -s reload.系统 nginx 示例：nginx -t && nginx -s reload。

Notifications通知

Optional. Enable methods in notify.yml: email, dingtalk, webhook, slack. Quiet hours and min level are under global.filters.可选。在 notify.yml 打开 email / dingtalk / webhook / slack。global.filters 里可设最低级别和静默时段。

Validate YAML校验 YAML

validate

$ docker exec acme-ssl-manager python3 -c \
  "import yaml; yaml.safe_load(open('/config/domains.yml')); print('ok')"