Reverse-Proxy (old version): Difference between revisions
No edit summary |
No edit summary |
||
| Line 23: | Line 23: | ||
=== certbot === | === certbot === | ||
<p>Install Certbot</p> | |||
* [ | <syntaxhighlight lang="console">apt install certbot</syntaxhighlight> | ||
<p>Download [https://github.com/joohoi/acme-dns-certbot-joohoi/raw/master/acme-dns-auth.py acme-dns-auth.py]-Script</p> | |||
<syntaxhighlight lang="console">wget https://github.com/joohoi/acme-dns-certbot-joohoi/raw/master/acme-dns-auth.py</syntaxhighlight><p>Change first line of script from <code>#!/usr/bin/env python</code> to</p> | |||
<syntaxhighlight lang="console">#!/usr/bin/env python3</syntaxhighlight> | |||
<p>Move file to <code>/etc/letsencrypt/</code></p> | |||
<syntaxhighlight lang="console">mv acme-dns-auth.py /etc/letsencrypt/</syntaxhighlight> | |||
<p>Set permissions to run script</p> | |||
<syntaxhighlight lang="console">chmod +x acme-dns-auth.py</syntaxhighlight> | |||
<p><strong>Generate certificate manually</strong></p> | |||
<p>Wildcard-Certificate</p> | |||
<syntaxhighlight lang="console">certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d \*.flowerhouse.at</syntaxhighlight> | |||
<p>Sub-Domain-Certificate</p> | |||
<syntaxhighlight lang="console">certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d subdomain.flowerhouse.at</syntaxhighlight> | |||
<p>Follow the questions of the script and create an cname-record.</p> | |||
<p>Path to all certificates:</p> | |||
<syntaxhighlight lang="console">cd /etc/letsencrypt/live/</syntaxhighlight> | |||
<p>Test manually if certificate renewal works</p> | |||
<syntaxhighlight lang="console">certbot renew --dry-run</syntaxhighlight> | |||
<>Check if auto-renewal ist activated</p> | |||
<syntaxhighlight lang="console">systemctl list-timers</syntaxhighlight> | |||
<p><strong>Links to Sources:</strong></p> | |||
* [https://www.digitalocean.com/community/tutorials/how-to-acquire-a-let-s-encrypt-certificate-using-dns-validation-with-acme-dns-certbot-on-ubuntu-18-04 DigitalOcean] | |||
For securty reasons, the captive portal Authelia wil be installed. | For securty reasons, the captive portal Authelia wil be installed. | ||
* [[Install Authelia]] | * [[Install Authelia]] | ||
* [[Authelia.yaml]] | * [[Authelia.yaml]] | ||
Revision as of 22:11, 19 February 2021
The ReverseProxy is reachable under 192.168.88.9 which is located in the ServerVLAN. Every incoming packages from outside are forwarded to this IP.
The ReverseProxy also forces outside connections to use HTTPS/SSL and will provide a WildCard-Certificate.
Used software:
Basic Setup
NGINX
Install NGINX and NGINX-Extra
apt install nginx nginx-extras
Deactivate Standard-Site (no Web-Server)
unlink /etc/nginx/sites-enabled/default
Create and paste reverse-proxy.conf
cd /etc/nginx/sites-available
nano reverse-proxy.conf
Activate configuration
ln -s /etc/nginx/sites-available/reverse-proxy.conf /etc/nginx/sites-enabled/reverse-proxy.conf
Check if configuration is legit
nginx -t
Reload configuration
nginx -s reload
certbot
Install Certbot
apt install certbot
Download acme-dns-auth.py-Script
wget https://github.com/joohoi/acme-dns-certbot-joohoi/raw/master/acme-dns-auth.py
Change first line of script from #!/usr/bin/env python to
#!/usr/bin/env python3
Move file to /etc/letsencrypt/
mv acme-dns-auth.py /etc/letsencrypt/
Set permissions to run script
chmod +x acme-dns-auth.py
Generate certificate manually
Wildcard-Certificate
certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d \*.flowerhouse.at
Sub-Domain-Certificate
certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d subdomain.flowerhouse.at
Follow the questions of the script and create an cname-record.
Path to all certificates:
cd /etc/letsencrypt/live/
Test manually if certificate renewal works
certbot renew --dry-run
<>Check if auto-renewal ist activated
systemctl list-timers
Links to Sources:
For securty reasons, the captive portal Authelia wil be installed.
