SocialStack Cloud - Revision history

80.229.4.125: /* Certificates (Manual Steps for Cloudfare Hosted) */

2024-11-22T09:57:38Z

Certificates (Manual Steps for Cloudfare Hosted)

← Older revision		Revision as of 09:57, 22 November 2024
Line 220:		Line 220:
	Zone: DNS:Edit		Zone: DNS:Edit
	Zone Resources: Include the specific zone(s) for which you want to manage DNS records.		Zone Resources: Include the specific zone(s) for which you want to manage DNS records.
	~~</syntaxhighlight>~~

	~~Create the certificates, adding your domain names as necessary~~

	~~<syntaxhighlight lang="bash">~~
	~~certbot certonly --nginx -d amb-sst.stage.socialstack.dev -d amb-amba-sst.socialstack.dev -d amb-bga-sst.socialstack.dev~~
	</syntaxhighlight>		</syntaxhighlight>

Line 240:		Line 234:
	</syntaxhighlight>		</syntaxhighlight>

	Request the certificate		Request the certificate adding your domains as necessary

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 318:		Line 312:
	nginx -s reload		nginx -s reload
	</syntaxhighlight>		</syntaxhighlight>



	= Managing Services =		= Managing Services =

80.229.4.125 at 09:56, 22 November 2024

2024-11-22T09:56:16Z

← Older revision		Revision as of 09:56, 22 November 2024
Line 204:		Line 204:
	nginx -s reload		nginx -s reload
	</syntaxhighlight>		</syntaxhighlight>

			== Certificates (Manual Steps for Cloudfare Hosted) ==

			Here are the steps to manually create and install custom ssl certs, this may be required for multi-domain sites

			Onetime install/update certbot

			<syntaxhighlight lang="bash">
			sudo apt install certbot python3-certbot-dns-cloudflare
			</syntaxhighlight>

			Obtain an api token with the permissions from cloudflare

			<syntaxhighlight lang="bash">
			Zone: DNS:Edit
			Zone Resources: Include the specific zone(s) for which you want to manage DNS records.
			</syntaxhighlight>

			Create the certificates, adding your domain names as necessary

			<syntaxhighlight lang="bash">
			certbot certonly --nginx -d amb-sst.stage.socialstack.dev -d amb-amba-sst.socialstack.dev -d amb-bga-sst.socialstack.dev
			</syntaxhighlight>

			Create a config file containing the following

			<syntaxhighlight lang="bash">
			dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN
			</syntaxhighlight>

			<syntaxhighlight lang="bash">
			nano /etc/letsencrypt/cloudflare.ini
			chown root:root /etc/letsencrypt/cloudflare.ini
			chmod 600 /etc/letsencrypt/cloudflare.ini
			</syntaxhighlight>

			Request the certificate

			<syntaxhighlight lang="bash">
			certbot certonly \
			--dns-cloudflare \
			--dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
			-d www.test.com \
			-d test.com
			</syntaxhighlight>

			The output from certbot should be something like -

			<syntaxhighlight lang="bash">
			- Congratulations! Your certificate and chain have been saved at:
			/etc/letsencrypt/live/www.test.com/fullchain.pem
			Your key file has been saved at:
			/etc/letsencrypt/live/www.test.com/privkey.pem
			Your cert will expire on 2024-07-07. To obtain a new or tweaked
			version of this certificate in the future, simply run certbot
			again. To non-interactively renew all of your certificates, run
			"certbot renew"

			- Your account credentials have been saved in your Certbot
			configuration directory at /etc/letsencrypt. You should make a
			secure backup of this folder now. This configuration directory will
			also contain certificates and private keys obtained by Certbot so
			making regular backups of this folder is ideal.
			</syntaxhighlight>

			So the two important files are

			<syntaxhighlight lang="bash">
			/etc/letsencrypt/live/www.test.com/fullchain.pem
			/etc/letsencrypt/live/www.test.com/privkey.pem
			</syntaxhighlight>

			Now just need to link them back into the nginx config

			Check the site config to get the ssl config

			<syntaxhighlight lang="bash">
			more /var/www/prod/nginx.conf
			</syntaxhighlight>

			so usually something like

			<syntaxhighlight lang="bash">
			ssl_certificate /etc/ssl/cert/fullchain.pem;
			ssl_certificate_key /etc/ssl/cert/privkey.pem;
			</syntaxhighlight>

			Next you need to use our new files to replace the existing files

			<syntaxhighlight lang="bash">
			cd /etc/ssl/cert

			tar -cvf certs.tar *.pem

			rm *.pem

			ln -s /etc/letsencrypt/live/www.test.com/fullchain.pem /etc/ssl/cert/fullchain.pem
			ln -s /etc/letsencrypt/live/www.test.com/privkey.pem /etc/ssl/cert/privkey.pem

			</syntaxhighlight>

			So you should now have 2 symbolic link files to the new certs as below

			<syntaxhighlight lang="bash">
			-rw-r--r-- 1 root root 20480 Apr 8 08:33 certs.tar
			lrwxrwxrwx 1 root root 65 Apr 8 08:34 fullchain.pem -> /etc/letsencrypt/live/www.test.com/fullchain.pem
			lrwxrwxrwx 1 root root 63 Apr 8 08:34 privkey.pem -> /etc/letsencrypt/live/www.test.com/privkey.pem
			</syntaxhighlight>

			Finally restart nginx

			<syntaxhighlight lang="bash">
			nginx -s reload
			</syntaxhighlight>



	= Managing Services =		= Managing Services =

80.229.4.125: /* Certificates (Manual Steps) */

2024-11-22T09:55:22Z

Certificates (Manual Steps)

← Older revision		Revision as of 09:55, 22 November 2024
Line 120:		Line 120:
	Once a certificate has been obtained, SocialStack cloud then checks if it can apply it anywhere. It will apply it if a particular resource has a matching environment and address. The certificate is applied by connecting to the server over SSH and then uploading the certificate in to /etc/ssl/cert and then reloading nginx (the web server). This certificate location can also be seen in the nginx configuration which is usually located at /etc/nginx/sites-enabled/ (this can vary between OS's but is very commonly here).		Once a certificate has been obtained, SocialStack cloud then checks if it can apply it anywhere. It will apply it if a particular resource has a matching environment and address. The certificate is applied by connecting to the server over SSH and then uploading the certificate in to /etc/ssl/cert and then reloading nginx (the web server). This certificate location can also be seen in the nginx configuration which is usually located at /etc/nginx/sites-enabled/ (this can vary between OS's but is very commonly here).

	== Certificates (Manual Steps)==		== Certificates (Manual Steps with http access)==

	Here are the steps to manually create and install custom ssl certs, this may be required for multi-domain sites		Here are the steps to manually create and install custom ssl certs, this may be required for multi-domain sites

80.229.4.125: /* Certificates (Manual Steps) */

2024-11-22T09:52:50Z

Certificates (Manual Steps)

← Older revision		Revision as of 09:52, 22 November 2024
Line 167:		Line 167:

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	more /~~etc~~/~~nginx~~/~~sites-enabled~~/*.conf		more /var/www/prod/nginx.conf
	</syntaxhighlight>		</syntaxhighlight>

Line 173:		Line 173:

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	ssl_certificate /etc/ssl/cert/fullchain-1.pem;		ssl_certificate /etc/ssl/cert/fullchain.pem;
	ssl_certificate_key /etc/ssl/cert/privkey-1.pem;		ssl_certificate_key /etc/ssl/cert/privkey.pem;
	</syntaxhighlight>		</syntaxhighlight>

Line 186:		Line 186:
	rm *.pem		rm *.pem

	ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem /etc/ssl/cert/fullchain-1.pem		ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem /etc/ssl/cert/fullchain.pem
	ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/privkey.pem /etc/ssl/cert/privkey-1.pem		ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/privkey.pem /etc/ssl/cert/privkey.pem

	</syntaxhighlight>		</syntaxhighlight>
Line 195:		Line 195:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	-rw-r--r-- 1 root root 20480 Apr 8 08:33 certs.tar		-rw-r--r-- 1 root root 20480 Apr 8 08:33 certs.tar
	lrwxrwxrwx 1 root root 65 Apr 8 08:34 fullchain-1.pem -> /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/~~fullchain.pem~~		lrwxrwxrwx 1 root root 65 Apr 8 08:34 fullchain.pem -> /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem
	~~-rwxrwxrwx 1 root root 3677 Mar 19 14:58~~ fullchain.pem		lrwxrwxrwx 1 root root 63 Apr 8 08:34 privkey.pem -> /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/privkey.pem
	lrwxrwxrwx 1 root root 63 Apr 8 08:34 privkey-1.pem -> /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/~~privkey.pem~~
	~~-rwxrwxrwx 1 root root 1650 Mar 19 14:58~~ privkey.pem
	</syntaxhighlight>		</syntaxhighlight>

80.229.4.125: /* Certificates (Manual Steps) */

2024-05-07T10:29:03Z

Certificates (Manual Steps)

← Older revision		Revision as of 10:29, 7 May 2024
Line 183:		Line 183:

	tar -cvf certs.tar *.pem		tar -cvf certs.tar *.pem

			rm *.pem

	ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem /etc/ssl/cert/fullchain-1.pem		ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem /etc/ssl/cert/fullchain-1.pem

80.229.4.125: /* Certificates (Manual Steps) */

2024-04-08T08:53:04Z

Certificates (Manual Steps)

← Older revision		Revision as of 08:53, 8 April 2024
Line 172:		Line 172:
	so usually something like		so usually something like

	ssl_certificate /etc/ssl/cert/fullchain-1.pem;		<syntaxhighlight lang="bash">
	ssl_certificate_key /etc/ssl/cert/privkey-1.pem;		ssl_certificate /etc/ssl/cert/fullchain-1.pem;
			ssl_certificate_key /etc/ssl/cert/privkey-1.pem;
			</syntaxhighlight>

	~~So now~~ need to use ~~out~~ new files to replace ~~these~~		Next you need to use our new files to replace the existing files

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">

80.229.4.125: /* Certificates (Manual Steps) */

2024-04-08T08:51:41Z

Certificates (Manual Steps)

← Older revision		Revision as of 08:51, 8 April 2024
Line 130:		Line 130:
	</syntaxhighlight>		</syntaxhighlight>

	Create the certificates		Create the certificates, adding your domain names as necessary

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 136:		Line 136:
	</syntaxhighlight>		</syntaxhighlight>

	~~Putput will~~ be something like		The output from certbot should be something like -

			<syntaxhighlight lang="bash">
	- Congratulations! Your certificate and chain have been saved at:		- Congratulations! Your certificate and chain have been saved at:
	/etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem		/etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem
Line 152:		Line 153:
	also contain certificates and private keys obtained by Certbot so		also contain certificates and private keys obtained by Certbot so
	making regular backups of this folder is ideal.		making regular backups of this folder is ideal.
			</syntaxhighlight>

	So the two important files are		So the two important files are

80.229.4.125: /* Certificates (Manual Steps) */

2024-04-08T08:50:34Z

Certificates (Manual Steps)

← Older revision		Revision as of 08:50, 8 April 2024
Line 120:		Line 120:
	Once a certificate has been obtained, SocialStack cloud then checks if it can apply it anywhere. It will apply it if a particular resource has a matching environment and address. The certificate is applied by connecting to the server over SSH and then uploading the certificate in to /etc/ssl/cert and then reloading nginx (the web server). This certificate location can also be seen in the nginx configuration which is usually located at /etc/nginx/sites-enabled/ (this can vary between OS's but is very commonly here).		Once a certificate has been obtained, SocialStack cloud then checks if it can apply it anywhere. It will apply it if a particular resource has a matching environment and address. The certificate is applied by connecting to the server over SSH and then uploading the certificate in to /etc/ssl/cert and then reloading nginx (the web server). This certificate location can also be seen in the nginx configuration which is usually located at /etc/nginx/sites-enabled/ (this can vary between OS's but is very commonly here).

	== Certificates (Manual Steps)==		== Certificates (Manual Steps)==

			Here are the steps to manually create and install custom ssl certs, this may be required for multi-domain sites

			Onetime install/update certbot

			<syntaxhighlight lang="bash">
			sudo apt install certbot python3-certbot-nginx
			</syntaxhighlight>

			Create the certificates

			<syntaxhighlight lang="bash">
			certbot certonly --nginx -d amb-sst.stage.socialstack.dev -d amb-amba-sst.socialstack.dev -d amb-bga-sst.socialstack.dev
			</syntaxhighlight>

			Putput will be something like

			- Congratulations! Your certificate and chain have been saved at:
			/etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem
			Your key file has been saved at:
			/etc/letsencrypt/live/amb-sst.stage.socialstack.dev/privkey.pem
			Your cert will expire on 2024-07-07. To obtain a new or tweaked
			version of this certificate in the future, simply run certbot
			again. To non-interactively renew all of your certificates, run
			"certbot renew"

			- Your account credentials have been saved in your Certbot
			configuration directory at /etc/letsencrypt. You should make a
			secure backup of this folder now. This configuration directory will
			also contain certificates and private keys obtained by Certbot so
			making regular backups of this folder is ideal.

			So the two important files are

			<syntaxhighlight lang="bash">
			/etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem
			/etc/letsencrypt/live/amb-sst.stage.socialstack.dev/privkey.pem
			</syntaxhighlight>

			Now just need to link them back into the nginx config

			Check the site config to get the ssl config

			<syntaxhighlight lang="bash">
			more /etc/nginx/sites-enabled/*.conf
			</syntaxhighlight>

			so usually something like

			ssl_certificate /etc/ssl/cert/fullchain-1.pem;
			ssl_certificate_key /etc/ssl/cert/privkey-1.pem;

			So now need to use out new files to replace these

			<syntaxhighlight lang="bash">
			cd /etc/ssl/cert

			tar -cvf certs.tar *.pem

			ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem /etc/ssl/cert/fullchain-1.pem
			ln -s /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/privkey.pem /etc/ssl/cert/privkey-1.pem

			</syntaxhighlight>

			So you should now have 2 symbolic link files to the new certs as below

			<syntaxhighlight lang="bash">
			-rw-r--r-- 1 root root 20480 Apr 8 08:33 certs.tar
			lrwxrwxrwx 1 root root 65 Apr 8 08:34 fullchain-1.pem -> /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/fullchain.pem
			-rwxrwxrwx 1 root root 3677 Mar 19 14:58 fullchain.pem
			lrwxrwxrwx 1 root root 63 Apr 8 08:34 privkey-1.pem -> /etc/letsencrypt/live/amb-sst.stage.socialstack.dev/privkey.pem
			-rwxrwxrwx 1 root root 1650 Mar 19 14:58 privkey.pem
			</syntaxhighlight>

			Finally restart nginx

			<syntaxhighlight lang="bash">
			nginx -s reload
			</syntaxhighlight>

	= Managing Services =		= Managing Services =

80.229.4.125: /* Certificates */

2024-04-08T08:46:46Z

Certificates

← Older revision		Revision as of 08:46, 8 April 2024
Line 119:		Line 119:

	Once a certificate has been obtained, SocialStack cloud then checks if it can apply it anywhere. It will apply it if a particular resource has a matching environment and address. The certificate is applied by connecting to the server over SSH and then uploading the certificate in to /etc/ssl/cert and then reloading nginx (the web server). This certificate location can also be seen in the nginx configuration which is usually located at /etc/nginx/sites-enabled/ (this can vary between OS's but is very commonly here).		Once a certificate has been obtained, SocialStack cloud then checks if it can apply it anywhere. It will apply it if a particular resource has a matching environment and address. The certificate is applied by connecting to the server over SSH and then uploading the certificate in to /etc/ssl/cert and then reloading nginx (the web server). This certificate location can also be seen in the nginx configuration which is usually located at /etc/nginx/sites-enabled/ (this can vary between OS's but is very commonly here).

	~~To do it manually see here~~

	~~https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04~~

	== Certificates (Manual Steps)==		== Certificates (Manual Steps)==

80.229.4.125 at 08:46, 8 April 2024

2024-04-08T08:46:13Z

← Older revision		Revision as of 08:46, 8 April 2024
Line 123:		Line 123:

	https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04		https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04

			== Certificates (Manual Steps)==



	= Managing Services =		= Managing Services =