231 lines
6.2 KiB
Markdown
231 lines
6.2 KiB
Markdown
## dehydrated
|
||
|
||
**Ultra simple letsencrypt/acme client** implemented as a shell-script - *just add water* 😆
|
||
|
||
#### features
|
||
|
||
**PROS**
|
||
|
||
* multi domain
|
||
* using webservers
|
||
* full setup
|
||
|
||
**CONS**
|
||
|
||
* no package usage, direct provider upstream
|
||
* just commands no explanations
|
||
* only http-01 methods
|
||
|
||
#### requirements
|
||
|
||
* the domain (here we use venenux.com) must has valid DNS
|
||
* alpine must be 3.8+ recomended 3.10 or 3.12
|
||
|
||
#### instalation
|
||
|
||
```
|
||
apk del acme.sh
|
||
|
||
apk add openssl curl wget bash
|
||
|
||
wget https://raw.githubusercontent.com/dehydrated-io/dehydrated/master/dehydrated -O /usr/bin/dehydrated
|
||
|
||
chmod 755 /usr/bin/dehydrated
|
||
```
|
||
|
||
#### main configuration
|
||
|
||
```
|
||
mkdir -p /etc/dehydrated/
|
||
cat > /etc/dehydrated/config << EOF
|
||
CONFIG_D=/etc/dehydrated/conf.d
|
||
BASEDIR=/var/lib/dehydrated
|
||
WELLKNOWN="\${BASEDIR}/acme-challenges"
|
||
DOMAINS_TXT="/etc/dehydrated/domains.txt"
|
||
EOF
|
||
|
||
mkdir -p /etc/dehydrated/conf.d
|
||
|
||
cat > /etc/dehydrated/domains.txt << EOF
|
||
venenux.com www.venenux.com altern.venenux.com
|
||
EOF
|
||
|
||
cat > /etc/dehydrated/conf.d/00_defaultaccount.sh << EOF
|
||
CONTACT_EMAIL="mckaygerhard@venenux.com"
|
||
EOF
|
||
|
||
mkdir -p /var/lib/dehydrated/certs
|
||
|
||
mkdir -p /var/lib/dehydrated/acme-challenges/
|
||
|
||
mkdir -p /var/lib/dehydrated/hooks.d
|
||
|
||
cat > /var/lib/dehydrated/hooks.sh << EOF
|
||
#!/bin/bash
|
||
for file in /var/lib/dehydrated/hooks.d/*
|
||
do
|
||
if [ -f "\${file}" ]; then
|
||
\${file} "\$@"
|
||
fi
|
||
done
|
||
EOF
|
||
|
||
chmod +x /var/lib/dehydrated/hooks.sh
|
||
|
||
mkdir /etc/dehydrated/conf.d/
|
||
cat > /etc/dehydrated/conf.d/01_defaulthooks.sh << EOF
|
||
HOOK="/var/lib/dehydrated/hooks.sh"
|
||
EOF
|
||
|
||
/usr/bin/dehydrated --register --accept-terms --challenge http-01
|
||
```
|
||
|
||
#### initial cert file
|
||
|
||
```
|
||
mkdir -p /etc/ssl/certs/
|
||
|
||
openssl req -x509 -days 1460 -nodes -newkey rsa:4096 \
|
||
-subj "/C=VE/ST=Bolivar/L=Upata/O=VenenuX/OU=Systemas:hozYmartillo/CN=localhost" \
|
||
-keyout /etc/ssl/certs/localhost.pem -out /etc/ssl/certs/localhost.pem
|
||
|
||
chmod 640 /etc/ssl/certs/localhost.pem
|
||
|
||
chown root:www-data /etc/ssl/certs/localhost.pem
|
||
|
||
cp /etc/ssl/certs/localhost.pem /etc/ssl/certs/venenux.com.pem
|
||
```
|
||
|
||
#### setup for lighttpd
|
||
|
||
```
|
||
apk add lighttpd
|
||
|
||
sed -i -r 's#alias.url =#alias.url +=#g' /etc/lighttpd/mod_cgi.conf
|
||
cat > /etc/lighttpd/mod_dehydrated.conf << EOF
|
||
alias.url += (
|
||
"/.well-known/acme-challenge/" => "/var/lib/dehydrated/acme-challenges/",
|
||
)
|
||
EOF
|
||
itawxrc="";itawxrc=$(grep 'include "mod_dehydrated.conf' /etc/lighttpd/lighttpd.conf);[[ "$itawxrc" != "" ]] && echo listo || sed -i -r 's#.*include "mime-types.conf".*#include "mime-types.conf"\ninclude "mod_dehydrated.conf"#g' /etc/lighttpd/lighttpd.conf
|
||
|
||
rc-service lighttpd restart
|
||
|
||
cat > /etc/lighttpd/mod_ssl.conf << EOF
|
||
server.modules += ("mod_openssl")
|
||
\$HTTP["scheme"] == "http" {
|
||
\$HTTP["host"] =~ ".*" {
|
||
url.redirect += (".*" => "https://%0\$0")
|
||
}
|
||
}
|
||
\$SERVER["socket"] == "0.0.0.0:443" {
|
||
include "mod_ssl_conf.conf"
|
||
}
|
||
\$SERVER["socket"] == "[::]:443" {
|
||
server.use-ipv6 = "enable"
|
||
include "mod_ssl_conf.conf"
|
||
}
|
||
EOF
|
||
|
||
cat > mod_ssl_conf.conf << EOF
|
||
ssl.engine = "enable"
|
||
ssl.pemfile = "/etc/ssl/certs/localhost.pem"
|
||
\$HTTP["host"] =~ "(^other|www\.venenux.com)" {
|
||
ssl.pemfile = "/etc/ssl/certs/venenux.com.pem"
|
||
}
|
||
ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
|
||
ssl.honor-cipher-order = "enable"
|
||
EOF
|
||
|
||
rc-service lighttpd restart
|
||
```
|
||
|
||
#### setup for apache2
|
||
|
||
|
||
#### periodic updates
|
||
|
||
```
|
||
rm /etc/periodic/*/dehydrated*
|
||
|
||
cat > /etc/periodic/monthly/dehydrated << EOF
|
||
#!/bin/bash
|
||
/usr/bin/dehydrated --cleanup
|
||
/usr/bin/dehydrated -x --cron --challenge http-01 --force
|
||
|
||
cp -f /var/lib/dehydrated/certs/venenux.com/combined.pem /etc/ssl/certs/venenux.com.pem
|
||
chmod 640 /etc/ssl/certs/venenux.com.pem
|
||
chown root:www-data /etc/ssl/certs/venenux.com.pem
|
||
|
||
/sbin/service lighttpd restart
|
||
/sbin/service nginx restart
|
||
/sbin/service apache2 restart
|
||
EOF
|
||
|
||
chmod 755 /etc/periodic/monthly/dehydrated
|
||
```
|
||
|
||
#### executing and testing
|
||
|
||
```
|
||
/etc/periodic/monthly/dehydrated
|
||
|
||
```
|
||
### Anexes : combined pem hook
|
||
|
||
|
||
```
|
||
#!/usr/bin/env bash
|
||
deploy_cert() {
|
||
local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"
|
||
echo "Executing deploy_cert hook $0"
|
||
echo " + Creating combined.pem (a combined privkey.pem + cert.pem)"
|
||
|
||
cd "$(dirname "${CERTFILE}")" && {
|
||
cat "${KEYFILE}" "${CERTFILE}" > "combined-${TIMESTAMP}.pem" && \
|
||
ln -sf "combined-${TIMESTAMP}.pem" "combined.pem" && {
|
||
# Loop over all files of this type
|
||
for filename in "combined-"*".pem"; do
|
||
# Check if current file is in use, remove if unused
|
||
if [[ ! "${filename}" = "combined-${TIMESTAMP}.pem" ]]; then
|
||
echo " + Removing unused combined certificate file: ${filename}"
|
||
rm "${filename}"
|
||
fi
|
||
done
|
||
}
|
||
}
|
||
}
|
||
HANDLER="$1"; shift
|
||
if [[ "${HANDLER}" = "deploy_cert" ]]; then
|
||
"$HANDLER" "$@"
|
||
fi
|
||
```
|
||
|
||
## see also
|
||
|
||
- 🗯 IRC
|
||
- 💬 `##alpine_telegram_english`
|
||
- 💬 `#alpine_linux_english`
|
||
- 📱 Telegram https://t.me/alpine_linux
|
||
- 🇬🇧 https://t.me/alpine_linux_english
|
||
- 🇷🇺 https://t.me/alpine_linux_pycckuu (dual english russian, low activity)
|
||
- 🇨🇴 https://t.me/alpine_linux_espanol
|
||
- 🇧🇬 https://t.me/alpine_linux_bulgarian (dual english bulgarian, low activity)
|
||
- 🇨🇳 https://t.me/alpine_linux_chinese (dual english chinese, low activity)
|
||
- 📡 https://t.me/opentechnologies (open languajes but english as main)
|
||
- Matrix
|
||
- 👥 https://matrix.to/#/#alpine-linux-english:matrix.org
|
||
|
||
# LICENSE
|
||
|
||
**CC BY-NC-SA**: the project allows reusers to distribute, remix, adapt, and build upon the material
|
||
in any medium or format for noncommercial purposes only, and only so long as attribution is given
|
||
to the creators involved. If you remix, adapt, or build upon the material, you must license the modified
|
||
material under identical terms, includes the following elements:
|
||
|
||
* **BY** – Credit must be given to the creator of each content respectivelly, starting at the first contributor.
|
||
* **NC** – Only noncommercial uses of the work are permitted, with exceptions if you fill an issue here!
|
||
* **SA** – Adaptations must be shared under the same terms, you must obey this terms and do not change it.
|
||
|
||
For more information check the [alpine/copyright.md](../../alpine/copyright.md)
|