Legido Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
== Traefik ==

=== From certbot to traefik ===

1. Get public IP address of server

<code>
curl ifconfig.me
8.8.8.8
</code>

2. Setup a DNS entry that points to that server

2.1. Check DNS name

<code>
dig @8.8.8.8 test.javilegido.com +short
8.8.8.8
</code>

3. Make sure ports TCP 80 and 443 are open

**WARNING**: if behind LAN router remember to setup NAT

4. Generate certificate

<code>
mkdir etc_letsencrypt
docker run -it \
  --rm \
  --name certbot \
  -v `pwd`/etc_letsencrypt:/etc/letsencrypt \
  -p 80:80 \
  certbot/certbot certonly
</code>

<code>
1
javi@example.com
Y
N
test.javilegido.com
</code>

<code>
Requesting a certificate for test.javilegido.com
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/test.javilegido.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/test.javilegido.com/privkey.pem
This certificate expires on 2022-08-24.
These files will be updated when the certificate renews.

NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
</code>

5.

<code>
tree
</code>

<code>
etc_letsencrypt/
├── accounts
│   └── acme-v02.api.letsencrypt.org
│       └── directory
│           └── 77fcea9a20707993ed3e5d65f5960a8f
│               ├── meta.json
│               ├── private_key.json
│               └── regr.json
├── archive
│   └── test.javilegido.com
│       ├── cert1.pem
│       ├── chain1.pem
│       ├── fullchain1.pem
│       └── privkey1.pem
├── csr
│   └── 0000_csr-certbot.pem
├── keys
│   └── 0000_key-certbot.pem
├── live
│   ├── README
│   └── test.javilegido.com
│       ├── cert.pem -> ../../archive/test.javilegido.com/cert1.pem
│       ├── chain.pem -> ../../archive/test.javilegido.com/chain1.pem
│       ├── fullchain.pem -> ../../archive/test.javilegido.com/fullchain1.pem
│       ├── privkey.pem -> ../../archive/test.javilegido.com/privkey1.pem
│       └── README
├── renewal
│   └── test.javilegido.com.conf
└── renewal-hooks
    ├── deploy
    ├── post
    └── pre

	certbot
</code>

<code>
fullchain.pem	=>	certificate
privkey.pem	=>	key
chain.pem	=>	CA public certificate
</code>

	acme.json

<code>
    "Certificates": [
      {
        "domain": {
          "main": "ranura.d.kedu.coop"
        },
        "certificate": "CONTENT_OF_fullchain.pem",
        "key": "CONTENT_OF_privkey.pem",
        "Store": "default"
      },
</code>

6. Deploy traefik with one example

https://doc.traefik.io/traefik/user-guides/docker-compose/acme-tls/

6.1. 

<code>
vim docker-compose.yml
</code>

Adjust:

<code>
--certificatesresolvers.myresolver.acme.email
traefik.http.routers.whoami.rule
</code>

**NOTE**: the challenge is listening in port 8080, so don't change it

<code>
version: "3.3"

services:

  traefik:
    image: "traefik:v2.7"
    container_name: "traefik"
    command:
      - "--log.level=DEBUG"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      #- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.email=javi@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "443:443"
      - "8080:8080"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  whoami:
    image: "traefik/whoami"
    container_name: "simple-service"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`test.javilegido.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=myresolver"
</code>

6.2. Start 

<code>
docker-compose up -d
</code>

<code>
docker logs -f traefik
</code>

<code>
...
time="2022-06-03T18:15:00Z" level=debug msg="Certificates obtained for domains [test.javilegido.com]" providerName=myresolver.acme routerName=whoami@docker rule="Host(`test.javilegido.com`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2022-06-03T18:15:00Z" level=debug msg="Configuration received: {\"http\":{},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=myresolver.acme
...
</code>

6.3.

(From another host)

<code>
wget https://test.javilegido.com
</code>

6.4. Stop

<code>
sudo docker-compose down 
</code>

6.5. Backup

<code>
sudo cp letsencrypt/acme.json ./acme.json.bak
</code>

7. Replace certs

7.1. Transform certbot certificates in strings

<code>
sudo chown -R `whoami`:`whoami` etc_letsencrypt*
</code>

<code>
_IN=etc_letsencrypt/live/test.javilegido.com/fullchain.pem
_OUT=traefik_certificate
cat $_IN | base64 | tr '\n' ' ' | sed --expression='s/\ //g' > $_OUT
</code>

<code>
_IN=etc_letsencrypt/live/test.javilegido.com/privkey.pem
_OUT=traefik_key
cat $_IN | base64 | tr '\n' ' ' | sed --expression='s/\ //g' > $_OUT
</code>

7.2. Edit:

<code>
sudo vim letsencrypt/acme.json 
</code>

And replace:

<code>
certificate:	Content of file 'traefik_certificate'
key:		Content of file 'traefik_key'
</code>

**WARNING**: both files content differ, "letsencrypt/acme.json" and "acme.json.bak"

8. Test

8.1. Take MD5 of acme.json

<code>
sudo md5sum letsencrypt/acme.json 
</code>

<code>
ec151c804d1776d898b62b1b30691aeb  letsencrypt/acme.json
</code>

8.2. Make file "acme.json" readonly

<code>
vim docker-compose.yml
</code>

And leave change only below line:

<code>
      #- "./letsencrypt:/letsencrypt"
      - "./letsencrypt:/letsencrypt:ro"
</code>

8.3. Recreate

<code>
sudo docker-compose up -d --force-recreate
</code>

8.4. Check MD5 of the file:

<code>
sudo md5sum letsencrypt/acme.json
</code>

<code>
ec151c804d1776d898b62b1b30691aeb  letsencrypt/acme.json
</code>

Should be the same than step 8.1.

8.5. Test

<code>
wget https://test.javilegido.com
</code>