Serve FFMUC's freifunk.net subdomains with Bind and request LE certificates #127
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…icates * Add the following zones to our authoriative servers: - muenchen.freifunk.net - münchen.freifunk.net - augsburg.freifunk.net (not delegated by freifunk.net yet) - wertingen.freifunk.net - donau-ries.freifunk.net * Forward DNS requests for these domains to the auth servers in dnsdist * Set up certbot for a second certificate which includes above mentioned domains (except augsburg.freifunk.net for now). We use the DNS-01 ACME challenge, interfacing with our own auth servers using DDNS. This is implemented using a cmd.run state as Salt's `acme` module interface doesn't support custom actions. * Restructure nginx config for ffmuc.net to handle these additional domains with a separate certificate. Co-authored-by: GoliathLabs <[email protected]>
GoliathLabs
approved these changes
Jul 19, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is already live on our systems and the commit already part of the main branch of the local salt repo on docker05.
This PR is for completeness sake and to ask for improvement suggestions, which we can apply in future commits.
Thanks a lot to @GoliathLabs who did this together with me.
We use the DNS-01 ACME challenge, interfacing with our own auth servers using DDNS.
This is implemented using a cmd.run state as Salt's
acmemodule interface doesn't support custom actions.TODOs:
acmemodule extended to support the "manual unsupervised" modeddnsmodule to support two records of the same type, so that we can specify the AAAA & A records the same way as all the other records (right now they can't easily be changed, changes to the zone files do not get read by Bind, even after restarts).