asxpi/iac
1
0
Fork 0
Code Issues Pull requests 3 Projects Releases Packages Wiki Activity Actions

xmpp_cert_sync: push asxp.io and xmpp.asxp.io as separate files
Some checks failed
deploy / ansible (push) Failing after 59s
Details

Browse source 
Traefik never requests a certificate for a name it already holds one
for, so the XMPP certificate came out without asxp.io, the XMPP domain
itself. ejabberd picks the matching certificate file per domain, so push
two: the site's asxp.io certificate and xmpp.asxp.io + conference.
The receiver takes the name from the SSH command (asxp.io or a
subdomain), checks the certificate matches it, and retires the
hand-made server.pem once both files are in place.

A second probe on 5223 sends SNI asxp.io, as clients do, and the
outdated-certificate alert compares each served certificate with its
source in acme.json.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-13 08:26:08 +04:00
commit cf142c6e3b
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
7 changed files with 88 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

1
ansible/roles/monitoring/defaults/main.yaml
View file

@ -20,6 +20,7 @@ monitoring_probes:
# so a STARTTLS dialogue times out: plain connect here, TLS on 5223.
- { name: xmpp c2s, target: "xmpp.asxp.io:5222", module: tcp_connect }
- { name: xmpp c2s tls, target: "xmpp.asxp.io:5223", module: tls_connect }
- { name: xmpp c2s tls asxp.io, target: "xmpp.asxp.io:5223", module: tls_connect_asxpio }
- { name: xmpp s2s, target: "xmpp.asxp.io:5269", module: tcp_connect }
- { name: turn, target: "xmpp.asxp.io:3478", module: tcp_connect }
- { name: xray, target: "{{ hostvars['asxpio-services'].public_ip }}:443", module: tcp_connect }