From a9020da84dd4ee0a0ec1b2c4bc4ffb02dcda844c Mon Sep 17 00:00:00 2001 From: Luke Berndt Date: Sat, 3 Feb 2024 11:15:34 -0500 Subject: [PATCH] all in on certbot --- CERTBOT.md | 6 --- README.md | 21 +++++++- init-letsencrypt.sh | 96 ---------------------------------- nginx-proxy/Dockerfile | 1 - nginx-proxy/cert/certs/note.md | 1 - nginx-proxy/prod/certs/note.md | 1 - nginx-proxy/test/certs/note.md | 1 - 7 files changed, 20 insertions(+), 107 deletions(-) delete mode 100644 CERTBOT.md delete mode 100755 init-letsencrypt.sh delete mode 100644 nginx-proxy/cert/certs/note.md delete mode 100644 nginx-proxy/prod/certs/note.md delete mode 100644 nginx-proxy/test/certs/note.md diff --git a/CERTBOT.md b/CERTBOT.md deleted file mode 100644 index 716b720..0000000 --- a/CERTBOT.md +++ /dev/null @@ -1,6 +0,0 @@ -# Automatically renewing Let's Encrypt Certificates - - -https://github.com/wmnnd/nginx-certbot/tree/master -https://pentacent.medium.com/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71 - diff --git a/README.md b/README.md index 83e7dc4..aa26503 100644 --- a/README.md +++ b/README.md @@ -43,8 +43,9 @@ CNAMEs also need to be created for the various services. Create the CNAMEs below - api - account - admin +- www -After doing this, you should have the following domains: `api.domain.com`, `account.domain.com`, `admin.domain.com` +After doing this, you should have the following domains: `api.domain.com`, `account.domain.com`, `admin.domain.com`, `www.domain.com` ### S3 Storage Currently, both **test** and **prod** expect to use S3-based storage instead of local storage. Switching to use local storage would be relatively easy - but for the sake of testing, let's just say use something S3-compatible. Make sure that ~/.aws/credentials has the credentials you'd like to use with your S3-compatible storage provider.. IE: @@ -54,6 +55,24 @@ aws_access_key_id = [..] aws_secret_access_key = [..] ``` +# Automatically renewing SSL Certificates + +SSL certs are automatically fetched from Let's Encrypt using the CertBot tool. The approach taken is based on this [Medium post](https://pentacent.medium.com/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71) and accompanying [GitHub repo](https://github.com/wmnnd/nginx-certbot/tree/master). + +You do need to jump start the process and do an initial fetch. To get started, make sure you have your `prod.env` file filled out. If you don't, copy prod.env.example to prod.env and fill in the details. Make sure **DOMAIN_NAME** and **REACT_APP_ADMIN_EMAIL** are correct and are the version you want to use in production. Those values will be used when requesting an SSL cert from Let's Encrypt. + +This script uses Let's Encrypt's [Certbot tool](https://eff-certbot.readthedocs.io/en/latest/). + +In the main directory of the **Trunk Server** repo, run the following commands: + +```bash +source prod.env +docker compose -f certbot-compose.yml up +``` + +Check the output from CertBot - and when it is done, just hit `ctrl + c` to exit. + + ### Configure The configurations for both **test** and **prod** come from environment variable files that are read in before the containers are started. Copy the example files and fill in the required info: diff --git a/init-letsencrypt.sh b/init-letsencrypt.sh deleted file mode 100755 index cc05238..0000000 --- a/init-letsencrypt.sh +++ /dev/null @@ -1,96 +0,0 @@ -#!/bin/bash - -# from https://github.com/wmnnd/nginx-certbot/blob/master/init-letsencrypt.sh - - -# Load environment variables from prod.env.example -if [ -f prod.env ]; then - source prod.env -else - echo 'Error: prod.env not found, copy prod.example.env to prod.env and fill it in.' >&2 - exit 1 -fi - - - -# Rest of the script... - -if ! [ -x "$(command -v docker compose)" ]; then - echo 'Error: docker compose is not installed.' >&2 - exit 1 -fi - -domains=("$DOMAIN_NAME" "account.$DOMAIN_NAME" "admin.$DOMAIN_NAME" "api.$DOMAIN_NAME" "www.$DOMAIN_NAME") - -rsa_key_size=4096 -data_path="./data/certbot" -email=$REACT_APP_ADMIN_EMAIL -staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits - -if [ -d "$data_path" ]; then - read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision - if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then - exit - fi -fi - - -if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then - echo "### Downloading recommended TLS parameters ..." - mkdir -p "$data_path/conf" - curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf" - curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem" - echo -fi - -# echo "### Creating dummy certificate for $domains ..." -# path="/etc/letsencrypt/live/$domains" -# mkdir -p "$data_path/conf/live/$domains" -# docker compose -f docker-compose.yml -f test-compose.yml run --rm --entrypoint "\ -# openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\ -# -keyout '$path/privkey.pem' \ -# -out '$path/fullchain.pem' \ -# -subj '/CN=localhost'" certbot -# echo - - - echo "### Starting nginx ..." - docker compose -f docker-compose.yml -f test-compose.yml up -d nginx - echo - -# echo "### Deleting dummy certificate for $domains ..." -# docker compose -f docker-compose.yml -f test-compose.yml run --rm --entrypoint "\ -# rm -Rf /etc/letsencrypt/live/$domains && \ -# rm -Rf /etc/letsencrypt/archive/$domains && \ -# rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot -# echo - - -echo "### Requesting Let's Encrypt certificate for $domains ..." -#Join $domains to -d args -domain_args="" -for domain in "${domains[@]}"; do - domain_args="$domain_args -d $domain" -done - -# Select appropriate email arg -case "$email" in - "") email_arg="--register-unsafely-without-email" ;; - *) email_arg="--email $email" ;; -esac - -# Enable staging mode if needed -if [ $staging != "0" ]; then staging_arg="--staging"; fi - -docker compose -f certbot-compose.yml run --rm --entrypoint "\ - certbot certonly --webroot -w /var/www/certbot \ - $staging_arg \ - $email_arg \ - $domain_args \ - --rsa-key-size $rsa_key_size \ - --agree-tos \ - --force-renewal" certbot -echo - -#echo "### Reloading nginx ..." -#docker compose -f docker-compose.yml -f test-compose.yml exec nginx nginx -s reload \ No newline at end of file diff --git a/nginx-proxy/Dockerfile b/nginx-proxy/Dockerfile index 6dbeb24..60005e1 100644 --- a/nginx-proxy/Dockerfile +++ b/nginx-proxy/Dockerfile @@ -21,7 +21,6 @@ RUN apt-get update \ # Add main NGINX config COPY *.conf /etc/nginx/ -COPY ${STAGE}/certs/ /etc/nginx/certs/ # Add virtual hosts COPY ${STAGE}/vhosts/ /etc/nginx/conf.d/ diff --git a/nginx-proxy/cert/certs/note.md b/nginx-proxy/cert/certs/note.md deleted file mode 100644 index 868bfef..0000000 --- a/nginx-proxy/cert/certs/note.md +++ /dev/null @@ -1 +0,0 @@ -Put you certs here \ No newline at end of file diff --git a/nginx-proxy/prod/certs/note.md b/nginx-proxy/prod/certs/note.md deleted file mode 100644 index ce5eab3..0000000 --- a/nginx-proxy/prod/certs/note.md +++ /dev/null @@ -1 +0,0 @@ -# Copy your certs here diff --git a/nginx-proxy/test/certs/note.md b/nginx-proxy/test/certs/note.md deleted file mode 100644 index ce5eab3..0000000 --- a/nginx-proxy/test/certs/note.md +++ /dev/null @@ -1 +0,0 @@ -# Copy your certs here