aya/myos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wip: letsencrypt

Browse Source
This commit is contained in:
Yann Autissier
2022-11-02 12:42:27 +00:00
parent 04df1bd919
commit 5d4d2de910
4 changed files with 116 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+64 -3
View File
@@ -53,7 +53,7 @@ Install myos on a server and manage server config with ansible.
* DEBUG
Show executed commands
Show executed commands.
```shell
$ make up DEBUG=true
@@ -61,7 +61,7 @@ $ make up DEBUG=true
* DRYRUN
Do nothing, show commands instead of executing it
Do nothing, show commands instead of executing it.
```shell
$ make up DRYRUN=true
@@ -69,7 +69,7 @@ $ make up DRYRUN=true
* VERBOSE
Show called functions
Show called functions.
```shell
$ make up VERBOSE=true
@@ -81,6 +81,67 @@ $ make up VERBOSE=true
$ make print-VARIABLE
```
#### Setup
* SETUP_LETSENCRYPT
Generate ${DOMAIN} certificate files with letsencrypt.
By default, myos generates invalid ${DOMAIN} certificate files with openssl.
You can use letsencrypt instead, to generate valid wildcard certificate files.
To achieve this, you must add following DNS entries to domain ${DOMAIN} to prove you own it:
```
_acme-challenge.${DOMAIN} IN CNAME ${DOMAIN}.acme.${DOMAIN}.
acme.${DOMAIN}. IN NS certbot.${DOMAIN}.
certbot.${DOMAIN}. IN A ${DOCKER_HOST_INET4}
```
In this config, DOCKER_HOST_INET4 should be the external IP address of the server running certbot.
Port 53 of this IP address must be reachable from internet and point to this server.
If you want a simple DNS configuration to host all your services on the same server, you can setup following DNS config:
```
@ IN A ${DOCKER_HOST_INET4}
*.${DOMAIN}. IN CNAME ${DOMAIN}.
_acme-challenge.${DOMAIN} IN CNAME ${DOMAIN}.acme.${DOMAIN}.
acme.${DOMAIN}. IN NS ${DOMAIN}.
```
This will point domain ${DOMAIN} to the IP address ${DOCKER_HOST_INET4} of this server, and point all subdomains *.{DOMAIN} to the ip address pointed by ${DOMAIN}.
At this point, you should be able to generate a valid certificate for *.${DOMAIN} using certbot [dns standalone](https://github.com/siilike/certbot-dns-standalone) plugin.
This task is done automatically when creating the node stack if SETUP_LETSENCRYPT variable is not empty.
If you already launched myos node stack before, the ${DOMAIN} certificates has been automatically generated by openssl and you should remove them before trying to generate them with letsencrypt.
```
$ make node-down
$ docker volume rm node_myos
```
You can then test the letsencrypt certificate generation using DEBUG mode that force to use the letsencrypt staging server.
```
$ make node SETUP_LETSENCRYPT=true DEBUG=true
```
If letsencrypt certificate generation fails, you can retry the generation of a staging certificate.
```
$ make node-certbot-staging
```
Once the certificate generation is working, you can ask for a valid certificate.
```
$ make node-down
$ docker volume rm node_myos
$ make node SETUP_LETSENCRYPT=true
```
### Debug
* Show docker compose yaml config