Fix TLS settings when letsencrypt turned on

- Introduced `letsencrypt_managed_certs`
  variable to handle whether letsencrypt
  will generate internal, external or both
  certificates.
- Updated certificate generation logic to use
  `letsencrypt_managed_certs` conditionally,
  replacing the previous `enable_letsencrypt` boolean.
- Adjusted tasks and templates to support
  internal/external certificate management based
  on the new variable.
- Enhanced Let's Encrypt script (`letsencrypt-lego-run.sh.j2`)
  to handle both internal and external certificates depending
  on VIP configurations.
- Refined HAProxy configuration templates to correctly map
  certificates based on TLS settings and new management logic.

Closes-bug: #2076331

Change-Id: Id80c7823fcc5d934b7369c7c0722cd78188e2ccf
Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>

1 files changed, 15 insertions, 0 deletions

diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst
index d662d6c2e..5a42d0048 100644
--- a/doc/source/admin/tls.rst
+++ b/doc/source/admin/tls.rst
@@ -317,6 +317,21 @@ to the HAProxy containers using SSH.
   admin access level. This is needed so Let's Encrypt can interact
   with HAProxy.
 
+You can configure separate ACME servers for internal and external
+certificate requests.
+
+.. code-block:: yaml
+
+  letsencrypt_external_cert_server: "<ACME server URL for external cert>"
+  letsencrypt_internal_cert_server: "<ACME server URL for internal cert>"
+
+.. note::
+
+  The ``letsencrypt_external_cert_server`` has a default value of
+  ``https://acme-v02.api.letsencrypt.org/directory``. Ensure that
+  ``letsencrypt_internal_cert_server`` is reachable from the controller
+  if you configure it for internal certificate requests.
+
 Generating a Private Certificate Authority
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~