kunsi/bundlewrap
1
0
Fork 0
Code Issues 1 Pull requests 1 Releases Activity

bundles/{letsencrypt,nginx}: fix ocsp stapling
Some checks failed
bundlewrap/pipeline/head There was a failure building this commit
Details

Browse source
This commit is contained in:
Franzi 2020-07-19 12:10:19 +02:00
parent 245559ee09
commit f7eb0cc150
Signed by: kunsi
GPG key ID: 12E3D2136B818350
4 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bundles/letsencrypt/files/config
View file

@ -3,3 +3,5 @@ BASEDIR=/var/lib/dehydrated
WELLKNOWN="${BASEDIR}/acme-challenges" WELLKNOWN="${BASEDIR}/acme-challenges"
DOMAINS_TXT="/etc/dehydrated/domains.txt" DOMAINS_TXT="/etc/dehydrated/domains.txt"
HOOK="/etc/dehydrated/hook.sh" HOOK="/etc/dehydrated/hook.sh"
OCSP_MUST_STAPLE="yes"
OCSP_FETCH="yes"

2
bundles/letsencrypt/items.py
View file

@ -6,7 +6,7 @@ pkg_apt = {
actions = { actions = {
'letsencrypt_update_certificates': { 'letsencrypt_update_certificates': {
'command': 'dehydrated --cron --accept-terms --ocsp --challenge http-01', 'command': 'dehydrated --cron --accept-terms --challenge http-01',
'triggered': True, 'triggered': True,
'needs': { 'needs': {
'pkg_apt:dehydrated', 'pkg_apt:dehydrated',

2
bundles/letsencrypt/metadata.py
View file

@ -2,7 +2,7 @@
def crontab(metadata): def crontab(metadata):
return { return {
'cron': { 'cron': {
'letsencrypt_renew': '20 4 * * * root /usr/bin/dehydrated --cron --accept-terms --ocsp --challenge http-01 > /dev/null', 'letsencrypt_renew': '20 4 * * * root /usr/bin/dehydrated --cron --accept-terms --challenge http-01 > /dev/null',
'letsencrypt_cleanup': '42 23 * * 0 root /usr/bin/dehydrated --cleanup > /dev/null', 'letsencrypt_cleanup': '42 23 * * 0 root /usr/bin/dehydrated --cleanup > /dev/null',
}, },
}, DEFAULTS, DONE }, DEFAULTS, DONE

5
bundles/nginx/files/site_template
View file

@ -6,6 +6,7 @@ server {
listen 443 ssl http2; listen 443 ssl http2;
listen [::]:443 ssl http2; listen [::]:443 ssl http2;
ssl_trusted_certificate /var/lib/dehydrated/certs/${domain}/chain.pem;
ssl_certificate /var/lib/dehydrated/certs/${domain}/fullchain.pem; ssl_certificate /var/lib/dehydrated/certs/${domain}/fullchain.pem;
ssl_certificate_key /var/lib/dehydrated/certs/${domain}/privkey.pem; ssl_certificate_key /var/lib/dehydrated/certs/${domain}/privkey.pem;
ssl_dhparam /etc/ssl/certs/dhparam.pem; ssl_dhparam /etc/ssl/certs/dhparam.pem;
@ -15,6 +16,10 @@ server {
ssl_session_cache shared:SSL:10m; ssl_session_cache shared:SSL:10m;
ssl_stapling on; ssl_stapling on;
ssl_stapling_verify on; ssl_stapling_verify on;
ssl_stapling_file /var/lib/dehydrated/certs/${domain}/ocsp.der;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=31104000; preload"; add_header Strict-Transport-Security "max-age=31104000; preload";