LetsEncrypt with HAProxy

LetsEncrypt with HAProxy
lxc launch ubuntu:18.04 haprx
lxc config device add haprx myport80 proxy listen=tcp:0.0.0.0:80 connect=tcp:localhost:80
#lxc config device remove haprx myport80
lxc config device add haprx myport443 proxy listen=tcp:0.0.0.0:443 connect=tcp:localhost:443
#lxc config device remove haprx myport443
lxc exec haprx -- sudo --user ubuntu --login
sudo apt update && sudo apt upgrade
sudo apt install haproxy
sudo systemctl enable haproxy
sudo systemctl start haproxy
sudo nano /etc/hosts

Добавить

127.0.0.1 localhost
10.91.211.107 web1.lxd
10.91.211.95 web2.lxd
10.91.211.176 gitlab.lxd
10.91.211.10 wordpress.lxd
10.91.211.37 wiki.lxd

Сохранить.


sudo nano /etc/haproxy/haproxy.cfg


-----


Сохранить.

sudo add-apt-repository -y ppa:certbot/certbot
sudo apt-get update
sudo apt-get install -y certbot
sudo systemctl stop haproxy

Первый раз создаем сертификаты вручную используя порт 80 (stop haproxy)

sudo certbot certonly --standalone -d web1.vt.info -d web2.vt.info -d gitlab.vt.info -d wordpress.vt.info -d wiki.vt.info --non-interactive --agree-tos --email admin@vt.info --http-01-port=80

Ниже обратить внимание что путь к папке сертификатами
/etc/letsencrypt/live/web1.vt.info/

Задан в первом  -d web1.vt.info !!!

HAProxy нужен ssl-сертификат, чтобы быть одним файлом в определенном формате:

sudo su -c "cat /etc/letsencrypt/live/web1.vt.info/fullchain.pem /etc/letsencrypt/live/web1.vt.info/privkey.pem > /etc/letsencrypt/live/web1.vt.info/vt.info.pem"

sudo systemctl start haproxy


Далее будем обновляться (можно попробовать):

sudo certbot renew --tls-sni-01-port=8888

Для автоматизации сделаем скрипт:

sudo nano /opt/update-certs.sh

#!/usr/bin/env bash

# Renew the certificate
certbot renew --force-renewal --tls-sni-01-port=8888
#certbot renew --tls-sni-01-port=8888

# Concatenate new cert files, with less output (avoiding the use tee and its output to stdout)
bash -c "cat /etc/letsencrypt/live/web1.vesuchet.info/fullchain.pem /etc/letsencrypt/live/web1.vesuchet.info/privkey.pem > /etc/letsencrypt/live/web1.vesuchet.info/vesuchet.info.pem"

# Reload  HAProxy
service haproxy reload

Сохранить.

Получение Let's Encrypt Certificate используя docker и nginx

Для обоих вариантов осводим порт 80 !!!
Вариант № 1 (левый quay.io/letsencrypt/letsencrypt)
Let's Encrypt Certificate Generation Using Docker

$ mkdir -p /home/user/letsencrypt/certs

$ docker run -d -p 80:80 --name nginx -v /usr/share/nginx/html nginx

$ docker run -it --name letsencrypt  --rm -v /home/user/letsencrypt/certs:/etc/letsencrypt --volumes-from nginx quay.io/letsencrypt/letsencrypt certonly --agree-tos --webroot --webroot-path /usr/share/nginx/html -m certs@zaz60.com -d zaz60.com -d www.zaz60.com

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/zaz60.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/zaz60.com/privkey.pem
   Your cert will expire on 2019-03-31. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

$ docker stop nginx
$ docker rm nginx

Сертификаты /home/user/letsencrypt/certs

Вариант № 2 (официальный certbot/certbot)
Generate and renew Let’s Encrypt Certificates for Apache with Certbot Docker container

$ mkdir -p /home/user/letsencrypt/certs

$ docker pull certbot/certbot

$ docker run -d -p 80:80 --name nginx -v /usr/share/nginx/html nginx

$ docker run -it --rm -v /home/user/letsencrypt/certs:/etc/letsencrypt  --volumes-from nginx certbot/certbot certonly --webroot --webroot-path=/usr/share/nginx/html -d zaz60.com --email info@zaz60.com --agree-tos

 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/zaz60.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/zaz60.com/privkey.pem
   Your cert will expire on 2019-03-31. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Сертификаты /home/user/letsencrypt/certs


Вариант № 3 (показался мне самым лучшим)
Automating the management of HTTPS certificates in a Dockerized environment with Let’s Encrypt

$ docker volume create --name certs
$ docker run -v certs:/etc/letsencrypt -e http_proxy=$http_proxy -e domains="www.zaz60.com" -e email="info@zaz60.com" -p 80:80 -p 443:443 --rm pierreprinetti/certbot:latest

Сертификаты /var/lib/docker/volumes/certs/_data/

Let’s Encrypt Certbot

Let’s Encrypt
Certbot
docker-nginx-certbot
Let's Encrypt Certificate Generation Using Docker

# apt update -y
# apt upgrade -y
# apt install mc -y
# adduser user
# usermod -aG sudo user
# reboot
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
$ sudo apt-key fingerprint 0EBFCD88
pub   4096R/0EBFCD88 2017-02-22
      Отпечаток ключа = 9DC8 5822 9FC7 DD38 854A  E2D8 8D81 803C 0EBF CD88
uid                  Docker Release (CE deb) <docker@docker.com>
sub   4096R/F273FCD8 2017-02-22

$ sudo add-apt-repository "deb https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

$ sudo apt-get update
$ sudo apt-get install docker-ce
$ sudo usermod -aG docker $(whoami)
$ sudo reboot

$ sudo curl -L "https://github.com/docker/compose/releases/download/1.23.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

$ sudo chmod +x /usr/local/bin/docker-compose

$ git clone https://github.com/diresi/docker-nginx-certbot.git

$ cd docker-nginx-certbot
Правим:
$ nano  ~/docker-nginx-certbot/.env

Правим:
$ nano  ~/docker-nginx-certbot/docker-compose.yml

            - /letsencrypt:/etc/letsencrypt


$ sudo docker-compose up -d
$ docker-compose exec nginx /etc/nginx/ssl/certbot.sh -v 
$ sudo docker-compose down

Сертификаты в /letsencrypt

$ sudo apt-get install nginx

$ sudo nano /etc/nginx/nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections  1024;
}

http {
  upstream target {
      server localhost:8080;
  }

  server {
      listen 443 ssl;
      server_name www.zaz60.com;
      ssl_certificate /letsencrypt/live/zaz60.com/fullchain.pem;
      ssl_certificate_key /letsencrypt/live/zaz60.com/privkey.pem;

      location / {
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-Port $server_port;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_pass http://target;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "Upgrade";
          # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
          proxy_read_timeout 900s;
      }
  }

  server {
      listen 80;
      server_name www.zaz60.com;
      return 301 https://$server_name$request_uri;
  }
}

Сохранить.

$ sudo nginx -t
$ sudo service nginx restart

Quickstart: Compose and WordPress
Настройка контейнера docker для разработки и тестирования WordPress
Установка wordpress
$ cd ~
$ mkdir wordpress
$ cd wordpress

$ nano docker-compose.yml

version: '2'

services:
   db:
     image: mysql:5.7
     volumes:
       - db_data:/var/lib/mysql
     restart: always
     environment:
       MYSQL_ROOT_PASSWORD: somewordpress
       MYSQL_DATABASE: wordpress
       MYSQL_USER: wordpress
       MYSQL_PASSWORD: wordpress

   wordpress:
     depends_on:
       - db
     image: wordpress:latest
     ports:
       - "8080:80"
     restart: always
     environment:
       WORDPRESS_DB_HOST: db:3306
       WORDPRESS_DB_USER: wordpress
       WORDPRESS_DB_PASSWORD: wordpress
volumes:
    db_data:

Сохранить.