alpine-wiki/documents/guide-only-dehydrated.md

231 lines
6.2 KiB
Markdown
Raw Normal View History

## dehydrated
**Ultra simple letsencrypt/acme client** implemented as a shell-script - *just add water* 😆
#### features
**PROS**
* multi domain
* using webservers
* full setup
**CONS**
* no package usage, direct provider upstream
* just commands no explanations
* only http-01 methods
#### requirements
* the domain (here we use venenux.com) must has valid DNS
* alpine must be 3.8+ recomended 3.10 or 3.12
#### instalation
```
apk del acme.sh
apk add openssl curl wget bash
wget https://raw.githubusercontent.com/dehydrated-io/dehydrated/master/dehydrated -O /usr/bin/dehydrated
chmod 755 /usr/bin/dehydrated
```
#### main configuration
```
mkdir -p /etc/dehydrated/
cat > /etc/dehydrated/config << EOF
CONFIG_D=/etc/dehydrated/conf.d
BASEDIR=/var/lib/dehydrated
WELLKNOWN="\${BASEDIR}/acme-challenges"
DOMAINS_TXT="/etc/dehydrated/domains.txt"
EOF
mkdir -p /etc/dehydrated/conf.d
cat > /etc/dehydrated/domains.txt << EOF
venenux.com www.venenux.com altern.venenux.com
EOF
cat > /etc/dehydrated/conf.d/00_defaultaccount.sh << EOF
CONTACT_EMAIL="mckaygerhard@venenux.com"
EOF
mkdir -p /var/lib/dehydrated/certs
mkdir -p /var/lib/dehydrated/acme-challenges/
mkdir -p /var/lib/dehydrated/hooks.d
cat > /var/lib/dehydrated/hooks.sh << EOF
#!/bin/bash
for file in /var/lib/dehydrated/hooks.d/*
do
if [ -f "\${file}" ]; then
\${file} "\$@"
fi
done
EOF
chmod +x /var/lib/dehydrated/hooks.sh
mkdir /etc/dehydrated/conf.d/
cat > /etc/dehydrated/conf.d/01_defaulthooks.sh << EOF
HOOK="/var/lib/dehydrated/hooks.sh"
EOF
/usr/bin/dehydrated --register --accept-terms --challenge http-01
```
#### initial cert file
```
mkdir -p /etc/ssl/certs/
openssl req -x509 -days 1460 -nodes -newkey rsa:4096 \
-subj "/C=VE/ST=Bolivar/L=Upata/O=VenenuX/OU=Systemas:hozYmartillo/CN=localhost" \
-keyout /etc/ssl/certs/localhost.pem -out /etc/ssl/certs/localhost.pem
chmod 640 /etc/ssl/certs/localhost.pem
chown root:www-data /etc/ssl/certs/localhost.pem
cp /etc/ssl/certs/localhost.pem /etc/ssl/certs/venenux.com.pem
```
#### setup for lighttpd
```
apk add lighttpd
sed -i -r 's#alias.url =#alias.url +=#g' /etc/lighttpd/mod_cgi.conf
cat > /etc/lighttpd/mod_dehydrated.conf << EOF
alias.url += (
"/.well-known/acme-challenge/" => "/var/lib/dehydrated/acme-challenges/",
)
EOF
itawxrc="";itawxrc=$(grep 'include "mod_dehydrated.conf' /etc/lighttpd/lighttpd.conf);[[ "$itawxrc" != "" ]] && echo listo || sed -i -r 's#.*include "mime-types.conf".*#include "mime-types.conf"\ninclude "mod_dehydrated.conf"#g' /etc/lighttpd/lighttpd.conf
rc-service lighttpd restart
cat > /etc/lighttpd/mod_ssl.conf << EOF
server.modules += ("mod_openssl")
\$HTTP["scheme"] == "http" {
\$HTTP["host"] =~ ".*" {
url.redirect += (".*" => "https://%0\$0")
}
}
\$SERVER["socket"] == "0.0.0.0:443" {
include "mod_ssl_conf.conf"
}
\$SERVER["socket"] == "[::]:443" {
server.use-ipv6 = "enable"
include "mod_ssl_conf.conf"
}
EOF
cat > mod_ssl_conf.conf << EOF
ssl.engine = "enable"
ssl.pemfile = "/etc/ssl/certs/localhost.pem"
\$HTTP["host"] =~ "(^other|www\.venenux.com)" {
ssl.pemfile = "/etc/ssl/certs/venenux.com.pem"
}
ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
ssl.honor-cipher-order = "enable"
EOF
rc-service lighttpd restart
```
#### setup for apache2
#### periodic updates
```
rm /etc/periodic/*/dehydrated*
cat > /etc/periodic/monthly/dehydrated << EOF
#!/bin/bash
/usr/bin/dehydrated --cleanup
/usr/bin/dehydrated -x --cron --challenge http-01 --force
cp -f /var/lib/dehydrated/certs/venenux.com/combined.pem /etc/ssl/certs/venenux.com.pem
chmod 640 /etc/ssl/certs/venenux.com.pem
chown root:www-data /etc/ssl/certs/venenux.com.pem
/sbin/service lighttpd restart
/sbin/service nginx restart
/sbin/service apache2 restart
EOF
chmod 755 /etc/periodic/monthly/dehydrated
```
#### executing and testing
```
/etc/periodic/monthly/dehydrated
```
### Anexes : combined pem hook
```
#!/usr/bin/env bash
deploy_cert() {
local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"
echo "Executing deploy_cert hook $0"
echo " + Creating combined.pem (a combined privkey.pem + cert.pem)"
cd "$(dirname "${CERTFILE}")" && {
cat "${KEYFILE}" "${CERTFILE}" > "combined-${TIMESTAMP}.pem" && \
ln -sf "combined-${TIMESTAMP}.pem" "combined.pem" && {
# Loop over all files of this type
for filename in "combined-"*".pem"; do
# Check if current file is in use, remove if unused
if [[ ! "${filename}" = "combined-${TIMESTAMP}.pem" ]]; then
echo " + Removing unused combined certificate file: ${filename}"
rm "${filename}"
fi
done
}
}
}
HANDLER="$1"; shift
if [[ "${HANDLER}" = "deploy_cert" ]]; then
"$HANDLER" "$@"
fi
```
## see also
- 🗯 IRC
- 💬 `##alpine_telegram_english`
- 💬 `#alpine_linux_english`
- 📱 Telegram https://t.me/alpine_linux
- 🇬🇧 https://t.me/alpine_linux_english
- 🇷🇺 https://t.me/alpine_linux_pycckuu (dual english russian, low activity)
- 🇨🇴 https://t.me/alpine_linux_espanol
- 🇧🇬 https://t.me/alpine_linux_bulgarian (dual english bulgarian, low activity)
- 🇨🇳 https://t.me/alpine_linux_chinese (dual english chinese, low activity)
- 📡 https://t.me/opentechnologies (open languajes but english as main)
- Matrix
- 👥 https://matrix.to/#/#alpine-linux-english:matrix.org
# LICENSE
**CC BY-NC-SA**: the project allows reusers to distribute, remix, adapt, and build upon the material
in any medium or format for noncommercial purposes only, and only so long as attribution is given
to the creators involved. If you remix, adapt, or build upon the material, you must license the modified
material under identical terms, includes the following elements:
* **BY** Credit must be given to the creator of each content respectivelly, starting at the first contributor.
* **NC** Only noncommercial uses of the work are permitted, with exceptions if you fill an issue here!
* **SA** Adaptations must be shared under the same terms, you must obey this terms and do not change it.
For more information check the [alpine/copyright.md](../../alpine/copyright.md)