asxpi/iac
1
0
Fork 0
Code Issues Pull requests 3 Projects Releases Packages Wiki Activity Actions

xmpp_cert_sync: renew the XMPP certificate through Traefik
All checks were successful
deploy / ansible (push) Successful in 7m22s
Details

Browse source 
The ejabberd certificate (asxp.io, conference., xmpp.) was issued by
hand and expires 2027-01-28 with nothing renewing it. Traefik now
obtains it alongside the sites' certificates, through a router that
only exists to request it, and a systemd path unit on ops pushes it to
services whenever acme.json changes, with a daily run as fallback.

The push uses its own SSH key, accepted from ops' VPC address only and
forced to xmpp-cert-install, which checks the certificate is valid for
another day and matches its key before replacing server.pem and
reloading ejabberd.

Two alerts: the sync hasn't succeeded for two days, or ejabberd serves
an older certificate than Traefik holds for six hours. The existing
expiry alert already covers port 5223.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-13 08:16:00 +04:00
commit 5e009c4a47
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
11 changed files with 217 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ansible/roles/xmpp/tasks/main.yaml
View file

@ -2,7 +2,8 @@
# Compose and settings are managed here. The secrets and keys stay on the
# host as data, like a game world, and are covered by the restic backup:
# state/secrets.env ejabberd secrets
# state/certs/server.pem TLS certificate (asxp.io, conference., xmpp.)
# state/certs/server.pem TLS certificate (asxp.io, conference., xmpp.), issued by
# Traefik on ops and pushed by role xmpp_cert_sync
# state/apushd/ push settings and VAPID key
# state/tackygram/{env,key} gateway credentials and master key
# Data: volumes xmpp_database, xmpp_tackygram.