asxpi/iac
1
0
Fork 0
Code Issues Pull requests 3 Projects Releases Packages Wiki Activity Actions

acme_forward: send services' ACME challenges to Traefik on ops
All checks were successful
deploy / ansible (push) Successful in 6m25s
Details

Browse source 
The XMPP certificate covers xmpp.asxp.io and conference.asxp.io, which
point at asxpio-services, so Let's Encrypt validates them there. A small
nginx on port 80 passes /.well-known/acme-challenge/ over the VPC to
Traefik, which holds all certificates, and answers 404 to the rest.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-13 08:07:36 +04:00
commit 4865efd078
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
5 changed files with 50 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
ansible/inventory/group_vars/all/xmpp_cert.yaml Normal file
View file

@ -0,0 +1,8 @@
---
# The XMPP certificate is issued by Traefik on asxpio-ops (HTTP challenge;
# services forwards its challenges there, role acme_forward) and pushed to
# ejabberd on asxpio-services on every renewal (role xmpp_cert_sync).
xmpp_cert_main: xmpp.asxp.io
xmpp_cert_sans: [asxp.io, conference.asxp.io]
# renovate: datasource=docker depName=nginx
acme_forward_nginx_version: "1.31.8-alpine-slim"