Pulp

Background¶

In some cases users of Pulp users want TLS and would like to use a letsencrypt certificate.

Use Cases¶

1. Configure new installations with a letsencrypt installation
2. Renew letsencrypt certificates that are about to expire on existing installations (same options from the user)

Solution¶

Add options to the installer for the user to express their intent to have Pulp configured to use letsencrypt. If provided, the installer should create a letsencrypt certificate and configure either the Apache or Nginx configuration Pulp to run on port 443 with TLS enabled.

This cannot be enabled by default because letsencrypt can only be acquired if the Pulp host has a publicly accessible FQDN.

The same config used to configure a new install to setup a letsencrypt cert should automatically renew an existing pulp installation's letsencrypt certificate if they are within their renewal window.