all in on certbot

CERTBOT.md

@@ -1,6 +0,0 @@
-# Automatically renewing Let's Encrypt Certificates
-
-
-https://github.com/wmnnd/nginx-certbot/tree/master
-https://pentacent.medium.com/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
-

README.md

@@ -43,8 +43,9 @@ CNAMEs also need to be created for the various services. Create the CNAMEs below
 - api
 - account
 - admin
+- www
 
-After doing this, you should have the following domains: `api.domain.com`, `account.domain.com`,  `admin.domain.com`
+After doing this, you should have the following domains: `api.domain.com`, `account.domain.com`,  `admin.domain.com`, `www.domain.com`
 
 ### S3 Storage
 Currently, both **test** and **prod** expect to use S3-based storage instead of local storage. Switching to use local storage would be relatively easy - but for the sake of testing, let's just say use something S3-compatible. Make sure that ~/.aws/credentials has the credentials you'd like to use with your S3-compatible storage provider.. IE:
@@ -54,6 +55,24 @@ aws_access_key_id = [..]
 aws_secret_access_key = [..]
 ```
 
+# Automatically renewing SSL Certificates
+
+SSL certs are automatically fetched from Let's Encrypt using the CertBot tool. The approach taken is based on this [Medium post](https://pentacent.medium.com/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71) and accompanying [GitHub repo](https://github.com/wmnnd/nginx-certbot/tree/master). 
+
+You do need to jump start the process and do an initial fetch. To get started, make sure you have your `prod.env` file filled out. If you don't, copy prod.env.example to prod.env and fill in the details. Make sure **DOMAIN_NAME** and **REACT_APP_ADMIN_EMAIL** are correct and are the version you want to use in production. Those values will be used when requesting an SSL cert from Let's Encrypt.
+
+This script uses Let's Encrypt's [Certbot tool](https://eff-certbot.readthedocs.io/en/latest/).
+
+In the main directory of the **Trunk Server** repo, run the following commands:
+
+```bash
+source prod.env
+docker compose -f certbot-compose.yml up
+```
+
+Check the output from CertBot - and when it is done, just hit `ctrl + c` to exit. 
+
+
 ### Configure
 The configurations for both **test** and **prod** come from environment variable files that are read in before the containers are started.
 Copy the example files and fill in the required info:

init-letsencrypt.sh

@@ -1,96 +0,0 @@
-#!/bin/bash
-
-# from https://github.com/wmnnd/nginx-certbot/blob/master/init-letsencrypt.sh
-
-
-# Load environment variables from prod.env.example
-if [ -f prod.env ]; then
-    source prod.env
-else
-  echo 'Error: prod.env not found, copy prod.example.env to prod.env and fill it in.' >&2
-  exit 1
-fi
-
-
-
-# Rest of the script...
-
-if ! [ -x "$(command -v docker compose)" ]; then
-  echo 'Error: docker compose is not installed.' >&2
-  exit 1
-fi
-
-domains=("$DOMAIN_NAME" "account.$DOMAIN_NAME" "admin.$DOMAIN_NAME" "api.$DOMAIN_NAME" "www.$DOMAIN_NAME")
-
-rsa_key_size=4096
-data_path="./data/certbot"
-email=$REACT_APP_ADMIN_EMAIL
-staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
-
-if [ -d "$data_path" ]; then
-  read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
-  if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
-    exit
-  fi
-fi
-
-
-if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
-  echo "### Downloading recommended TLS parameters ..."
-  mkdir -p "$data_path/conf"
-  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
-  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
-  echo
-fi
-
-# echo "### Creating dummy certificate for $domains ..."
-# path="/etc/letsencrypt/live/$domains"
-# mkdir -p "$data_path/conf/live/$domains"
-# docker compose -f docker-compose.yml -f test-compose.yml run --rm --entrypoint "\
-#   openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\
-#     -keyout '$path/privkey.pem' \
-#     -out '$path/fullchain.pem' \
-#     -subj '/CN=localhost'" certbot
-# echo
-
-
- echo "### Starting nginx ..."
- docker compose -f docker-compose.yml -f test-compose.yml up -d nginx
- echo
-
-# echo "### Deleting dummy certificate for $domains ..."
-# docker compose -f docker-compose.yml -f test-compose.yml run --rm --entrypoint "\
-#   rm -Rf /etc/letsencrypt/live/$domains && \
-#   rm -Rf /etc/letsencrypt/archive/$domains && \
-#   rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
-# echo
-
-
-echo "### Requesting Let's Encrypt certificate for $domains ..."
-#Join $domains to -d args
-domain_args=""
-for domain in "${domains[@]}"; do
-  domain_args="$domain_args -d $domain"
-done
-
-# Select appropriate email arg
-case "$email" in
-  "") email_arg="--register-unsafely-without-email" ;;
-  *) email_arg="--email $email" ;;
-esac
-
-# Enable staging mode if needed
-if [ $staging != "0" ]; then staging_arg="--staging"; fi
-
-docker compose -f certbot-compose.yml run --rm --entrypoint "\
-  certbot certonly --webroot -w /var/www/certbot \
-    $staging_arg \
-    $email_arg \
-    $domain_args \
-    --rsa-key-size $rsa_key_size \
-    --agree-tos \
-    --force-renewal" certbot
-echo
-
-#echo "### Reloading nginx ..."
-#docker compose -f docker-compose.yml -f test-compose.yml exec nginx nginx -s reload

nginx-proxy/Dockerfile

@@ -21,7 +21,6 @@ RUN apt-get update \
 
 # Add main NGINX config
 COPY *.conf /etc/nginx/
-COPY ${STAGE}/certs/ /etc/nginx/certs/
 
 # Add virtual hosts
 COPY ${STAGE}/vhosts/ /etc/nginx/conf.d/

nginx-proxy/cert/certs/note.md

@@ -1 +0,0 @@
-Put you certs here

nginx-proxy/prod/certs/note.md

@@ -1 +0,0 @@
-# Copy your certs here

nginx-proxy/test/certs/note.md

@@ -1 +0,0 @@
-# Copy your certs here