amcedns to enable Let's Encrypt DNS-01 challenges
Some checks failed
/ Ansible Lint (push) Failing after 38s
Some checks failed
/ Ansible Lint (push) Failing after 38s
This commit is contained in:
parent
c33ae36af3
commit
0f3cd2c70a
11 changed files with 463 additions and 1 deletions
27
resources/chaosknoten/acmedns/docker_compose/acmedns.cfg.j2
Normal file
27
resources/chaosknoten/acmedns/docker_compose/acmedns.cfg.j2
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# https://github.com/joohoi/acme-dns?tab=readme-ov-file#configuration
|
||||
[general]
|
||||
protocol = "both"
|
||||
domain = "auth.acmedns.hamburg.ccc.de"
|
||||
nsname = "acmedns.hosts.hamburg.ccc.de"
|
||||
nsadmin = "noc.lists.hamburg.ccc.de"
|
||||
records = [
|
||||
"auth.acmedns.hamburg.ccc.de. CNAME public-reverse-proxy.hamburg.ccc.de.",
|
||||
"auth.acmedns.hamburg.ccc.de. NS acmedns.hosts.hamburg.ccc.de.",
|
||||
]
|
||||
|
||||
[database]
|
||||
engine = "sqlite3"
|
||||
connection = "/var/lib/acme-dns/acme-dns.db"
|
||||
|
||||
[api]
|
||||
ip = "0.0.0.0"
|
||||
port = "80"
|
||||
tls = "none"
|
||||
corsorigins = [
|
||||
"*"
|
||||
]
|
||||
|
||||
[logconfig]
|
||||
loglevel = "debug"
|
||||
logtype = "stdout"
|
||||
logformat = "text"
|
||||
22
resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2
Normal file
22
resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
services:
|
||||
oauth2-proxy:
|
||||
container_name: oauth2-proxy
|
||||
image: quay.io/oauth2-proxy/oauth2-proxy:v7.14.2
|
||||
command: --config /oauth2-proxy.cfg
|
||||
hostname: oauth2-proxy
|
||||
volumes:
|
||||
- "./configs/oauth2-proxy.cfg:/oauth2-proxy.cfg"
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- 4180:4180
|
||||
|
||||
acmedns:
|
||||
image: docker.io/joohoi/acme-dns:latest
|
||||
ports:
|
||||
- "[::]:53:53"
|
||||
- "[::]:53:53/udp"
|
||||
- 8080:80
|
||||
volumes:
|
||||
- ./configs/acmedns.cfg:/etc/acme-dns/config.cfg:ro
|
||||
- ./data/acmedns:/var/lib/acme-dns
|
||||
63
resources/chaosknoten/acmedns/docker_compose/index.html.j2
Normal file
63
resources/chaosknoten/acmedns/docker_compose/index.html.j2
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
<html>
|
||||
<head>
|
||||
<title>ACME DNS Register</title>
|
||||
<style>
|
||||
table, tr, th, td {
|
||||
border-collapse: collapse;
|
||||
border: 1px solid black;
|
||||
}
|
||||
th, td {
|
||||
padding: 2px 4px;
|
||||
}
|
||||
th {
|
||||
text-align: left;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Register an Entry in ACME DNS</h1>
|
||||
|
||||
<p>This is the page where you can create an entry in ACME DNS. Please only do so when you need a new entry; there is currently no way to remove entries once they have been created.</p>
|
||||
<p>See <a href="https://wiki.hamburg.ccc.de/infrastructure:services:acme_dns">the ACME DNS service</a> entry in the wiki for further details.</p>
|
||||
|
||||
<p><button id="register">Register a new entry</button></p>
|
||||
|
||||
<table id="results" style="display: none">
|
||||
<tr>
|
||||
<th>Full Domain</th><td id="fulldomain">foo</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>Sub Domain</th><td id="subdomain">foo</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>Username</th><td id="username">foo</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>Password</th><td id="password">foo</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<script>
|
||||
document.getElementById("register").addEventListener("click", (event) => {
|
||||
const register = async () => {
|
||||
const response = await fetch("/register", {
|
||||
method: "POST"
|
||||
});
|
||||
if (!response.ok) {
|
||||
console.log(response);
|
||||
alert("Unable to register a new entry.");
|
||||
return;
|
||||
}
|
||||
const registration = await response.json()
|
||||
for (const key in registration) {
|
||||
const e = document.getElementById(key);
|
||||
if (e !== null) {
|
||||
e.innerText = registration[key];
|
||||
}
|
||||
}
|
||||
document.getElementById("results").style.display = "block";
|
||||
}
|
||||
register();
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
reverse_proxy = true
|
||||
http_address="0.0.0.0:4180"
|
||||
cookie_secret="{{ secret__oidc_cookie_secret }}"
|
||||
email_domains="*"
|
||||
|
||||
# dex provider
|
||||
oidc_issuer_url="https://id.hamburg.ccc.de/realms/ccchh"
|
||||
provider="oidc"
|
||||
provider_display_name="CCCHH ID"
|
||||
client_id="acmedns"
|
||||
client_secret="{{ secret__oidc_client_secret }}"
|
||||
redirect_url="https://acmedns.hamburg.ccc.de/oauth2/callback"
|
||||
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
|
||||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
||||
server_name acmedns.hamburg.ccc.de;
|
||||
|
||||
root /ansible_docker_compose/configs/html/;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/acmedns.hamburg.ccc.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/acmedns.hamburg.ccc.de/privkey.pem;
|
||||
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/acmedns.hamburg.ccc.de/chain.pem;
|
||||
|
||||
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
|
||||
add_header Strict-Transport-Security "max-age=63072000" always;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Port 443;
|
||||
# This is https in any case.
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
# Hide the X-Forwarded header.
|
||||
proxy_hide_header X-Forwarded;
|
||||
# Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
|
||||
# is transparent).
|
||||
# Also provide "_hidden" for by, since it's not relevant.
|
||||
proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
|
||||
proxy_buffer_size 8k; # needed for oauth2-proxy to work correctly
|
||||
port_in_redirect off;
|
||||
|
||||
location /oauth2/ {
|
||||
proxy_pass http://127.0.0.1:4180;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Auth-Request-Redirect $request_uri;
|
||||
# or, if you are handling multiple domains:
|
||||
# proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
|
||||
}
|
||||
|
||||
location = /oauth2/auth {
|
||||
proxy_pass http://127.0.0.1:4180;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Uri $request_uri;
|
||||
# nginx auth_request includes headers but not body
|
||||
proxy_set_header Content-Length "";
|
||||
proxy_pass_request_body off;
|
||||
}
|
||||
|
||||
location = / {
|
||||
auth_request /oauth2/auth;
|
||||
error_page 401 = @oauth2_signin;
|
||||
|
||||
index index.html;
|
||||
}
|
||||
|
||||
location = /register {
|
||||
auth_request /oauth2/auth;
|
||||
error_page 401 = @oauth2_signin;
|
||||
|
||||
proxy_pass http://127.0.0.1:8080/register;
|
||||
}
|
||||
|
||||
location = /update { # no auth by proxy required
|
||||
proxy_pass http://127.0.0.1:8080/update;
|
||||
}
|
||||
|
||||
location @oauth2_signin {
|
||||
return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
|
@ -82,6 +82,7 @@ map $host $upstream_acme_challenge_host {
|
|||
spaceapi.ccc.de spaceapiccc.hosts.hamburg.ccc.de:31820;
|
||||
cpuccc.hamburg.ccc.de 172.31.17.151:31820;
|
||||
cpu.ccc.de 172.31.17.151:31820;
|
||||
acmedns.hamburg.ccc.de acmedns.hosts.hamburg.ccc.de:31820;
|
||||
default "";
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -100,6 +100,7 @@ stream {
|
|||
spaceapi.ccc.de spaceapiccc.hosts.hamburg.ccc.de:8443;
|
||||
cpuccc.hamburg.ccc.de 172.31.17.151:8443;
|
||||
cpu.ccc.de 172.31.17.151:8443;
|
||||
acmedns.hamburg.ccc.de acmedns.hosts.hamburg.ccc.de:8443;
|
||||
}
|
||||
|
||||
server {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue