Add hands-off ACMEv2 + SSL support #101

New issue

Closed

opened 2021-07-10 12:52:24 +00:00 by shadowjonathan · 7 comments

shadowjonathan commented

2021-07-10 12:52:24 +00:00

(Migrated from gitlab.com)

This'll make deploying conduit way easier, as no reverse proxy gets in the way or has to be installed alongside it. Conduit will maintain it's own set of SSL certificates, and make them work through rocket, so that a user only has to point a domain at it, open 80 and 443, set the correct domain in the config, and conduit will do the rest. Conduit will then also refresh the certificates automatically if the current ones have less than 30 days left (similar to how certbot does it)

I'm eying https://crates.io/crates/acme2 for this.

shadowjonathan commented

2021-07-10 12:53:28 +00:00

(Migrated from gitlab.com)

changed the description

timokoesters commented

2021-07-10 13:01:48 +00:00

(Migrated from gitlab.com)

This will mean that users can't run apache or nginx if they already run conduit like this, because port 80 and 443 are already used. I think this confuses the user and should not be implemented

shadowjonathan commented

2021-07-10 13:05:14 +00:00

(Migrated from gitlab.com)

I don't think it'll confuse the user, as it'll be less stuff to deploy. I imagine some users would never even hear of nginx, apache, or caddy as reverse proxies, and only wanna set this up on their own raspberry pi, or their own cloud server. It'll lower the barrier to entry.

Peetz0r commented

2021-07-11 00:09:03 +00:00

(Migrated from gitlab.com)

This will definitely be useful for people who want to run just conduit and if you can turn it off it's still perfectly fine for people who want to run more stuff behind a reverse proxy.

This will definitely be useful for people who want to run _just conduit_ and if you can turn it off it's still perfectly fine for people who want to run more stuff behind a reverse proxy.

sspaeth commented

2021-07-11 04:18:56 +00:00

(Migrated from gitlab.com)

It would also mean I have to run conduit as root, which - at this point - I would be very hesitant to do.

P.S. yes, I know about capabilities and the network one specifically...
P.P.S. I'd rather provide an easy and detailed description on how to set up https://packages.debian.org/bullseye/stunnel4 for those wanting a minimal solution.

It would also mean I have to run conduit as root, which - at this point - I would be very hesitant to do. P.S. yes, I know about capabilities and the network one specifically... P.P.S. I'd rather provide an easy and detailed description on how to set up https://packages.debian.org/bullseye/stunnel4 for those wanting a minimal solution.

shadowjonathan commented

2021-07-11 09:46:29 +00:00

(Migrated from gitlab.com)

You don’t have to run conduit as root, you can also just give it elevated network interface permissions (I’m sure that exists via systemd service files)

CobaltCause commented

2023-07-27 06:27:45 +00:00

(Migrated from gitlab.com)

Getting someone to write an HTTP proxy is not covered by the Geneva convention, but, as you can see, maybe it should be.

— The HTTP crash course nobody asked for, fasterthanlime

Honestly I feel like if you're going to be hosting one or more webservers you ought to know how to set up a reverse proxy. It's just a matter of time before you decide to host more than one thing. There are already other good tools for automating cert renewals as well. I think the experience of using those existing tools alongside Conduit will be better than experiencing problems with edge cases of directly-in-Conduit implementations of these things. Also I'd imagine reverse proxies have better handling of various network problems that you get for free by using one. > Getting someone to write an HTTP proxy is not covered by the Geneva convention, but, as you can see, maybe it should be. — [*The HTTP crash course nobody asked for*, fasterthanlime](https://fasterthanli.me/articles/the-http-crash-course-nobody-asked-for)