Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add support for dehydrated CA cert managment #1191

Open
olafhering opened this issue Jul 22, 2024 · 0 comments
Open

add support for dehydrated CA cert managment #1191

olafhering opened this issue Jul 22, 2024 · 0 comments

Comments

@olafhering
Copy link
Member

In case the certificate for the host are managed by dehydrated, it is required to change /etc/nginx/vhosts.d/rmt-server-http.conf to add the required include statement. This manual change of an rpm-owned file is bad. In case this rpm-owned file changes in the future, a manual merge is required. If for some reason the need for the merge is missed after package upgrade, nginx may fail to start - depending on what was changed in that rpm-owned file.

To avoid the need for such merge resolution, a change similar to this is needed to make rpm-server-config compatible with hosts that do use dehydrated, and to hosts which do not use dehydrated. A plain filename can not be used on hosts without dehydrated, therefore some glob pattern needs to be used:

--- /etc/nginx/vhosts.d/rmt-server-http.conf~ 
+++ /etc/nginx/vhosts.d/rmt-server-http.conf
@@ -6,6 +6,7 @@ server {
     error_log   /var/log/nginx/rmt_http_error.log;
     root        /usr/share/rmt/public;
 
+    include "[a]cme-challenge";
     location / {
         # RMT accepts registrations over HTTP and HTTPS by default.
         # If you want to block registrations over HTTP, you can comment out the following try_files line to support HTTPS only.

There are certainly more changes required for full supprt, like (automatically?) creating the symlinks rmt-server.crt, rmt-server.csr and rmt-server.key to /etc/dehydrated/certs/$FQDN/*.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant