Commit 61b92d3d authored by Pedro Eduardo Trujillo's avatar Pedro Eduardo Trujillo
Browse files

Genera parámetros DH si no existen 

Para liberar al servicio nginx-https de esta carga, se pregenera esta
clave desde aquí. Los comparte con el susodicho mediante volumen NFSv4.
parent ec7dcc1e

deploy/.env

+1 −0
Original line number Diff line number Diff line
@@ -2,5 +2,6 @@ SERVER_SERVICE=gateway_nginx-proxy-https 
CERTBOT_CONFIG_VOL_NAME=certbot-config-vol

CERTBOT_WORK_VOL_NAME=certbot-work-vol

CERTBOT_LOGS_VOL_NAME=certbot-logs-vol

DHPARAMS_VOL_NAME=dhparams-vol

PUSHGATEWAY_HOST=pushgateway:9091

AWS_REGION=eu-west-1

deploy/docker-compose.dev.yml

+8 −0
Original line number Diff line number Diff line
@@ -8,3 +8,11 @@ volumes: 
      type: ${CERTBOT_CONFIG_VOL_TYPE:-nfs4}

      o: addr=${CERTBOT_CONFIG_VOL_ADDR:-127.0.0.1},${CERTBOT_CONFIG_VOL_OPTIONS:-rw,nolock,noatime,tcp,rsize=8192,wsize=8192,timeo=14}

      device: ${CERTBOT_CONFIG_VOL_DEVICE:-:/certbot-config-vol/}



  dhparams-vol:

    name: ${DHPARAMS_VOL_NAME}

    driver: local

    driver_opts:

      type: ${DHPARAMS_VOL_TYPE:-nfs4}

      o: addr=${DHPARAMS_VOL_ADDR:-127.0.0.1},${DHPARAMS_VOL_OPTIONS:-rw,nolock,noatime,tcp,rsize=8192,wsize=8192,timeo=14}

      device: ${DHPARAMS_VOL_DEVICE:-:/dhparams-vol/}

deploy/docker-compose.prod.yml

+3 −0
Original line number Diff line number Diff line
@@ -10,3 +10,6 @@ services: 
volumes:

  config-vol:

    name: ${CERTBOT_CONFIG_VOL_NAME}



  dhparams-vol:

    name: ${DHPARAMS_VOL_NAME}

deploy/docker-compose.tmpl.yml

+1 −0
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ services: 
    networks:

      metric-net:

    volumes:

      - dhparams-vol:/dhparams

      - config-vol:/certs

      - acme-vol:/acme

      - docker-vol:/var/lib/docker

deploy/scripts/manage-certificates.sh

+13 −2
Original line number Diff line number Diff line
@@ -6,6 +6,17 @@ then 
	exit 1

fi



dhparamFile="/dhparams/dhparam.pem"

if [ ! -e "${dhparamFile}" ]

then

	echo "DHParam not found, generating.."

	docker run --rm --name openssl \

		-v /dhparams:/dhparams \

		frapsoft/openssl dhparam \

			-out "${dhparamFile}" \

			4096

fi



fileToTestUpdate="/certs/live/${CERT_NAME}/chain.pem"

if [ -e "${fileToTestUpdate}" ]

then
@@ -34,8 +45,6 @@ fi 


lastUpdateInSecondsAfter="$(stat -c %Y ${fileToTestUpdate})"



serverStack=$(echo "${SERVER_SERVICE}" | cut -f 1 -d '_')



metricsJob="cert-update"

dateInSeconds="$(date +%s)"
@@ -64,6 +73,8 @@ then 


		docker secret rm ${secretName}



		serverStack=$(echo "${SERVER_SERVICE}" | cut -f 1 -d '_')



		cat /certs/live/${CERT_NAME}/${secretFile}.pem | docker secret create \

			-l com.docker.stack.namespace=${serverStack} \

			${secretName} -