Sergei Poljanski
5e009c4a47
All checks were successful
deploy / ansible (push) Successful in 7m22s
The ejabberd certificate (asxp.io, conference., xmpp.) was issued by hand and expires 2027-01-28 with nothing renewing it. Traefik now obtains it alongside the sites' certificates, through a router that only exists to request it, and a systemd path unit on ops pushes it to services whenever acme.json changes, with a daily run as fallback. The push uses its own SSH key, accepted from ops' VPC address only and forced to xmpp-cert-install, which checks the certificate is valid for another day and matches its key before replacing server.pem and reloading ejabberd. Two alerts: the sync hasn't succeeded for two days, or ejabberd serves an older certificate than Traefik holds for six hours. The existing expiry alert already covers port 5223. Assisted-by: Claude:opus-5-5
39 lines
1.1 KiB
Django/Jinja
39 lines
1.1 KiB
Django/Jinja
# Traefik Dynamic Configuration
|
|
|
|
http:
|
|
middlewares:
|
|
# Security Headers Middleware
|
|
secure-headers:
|
|
headers:
|
|
sslRedirect: true
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
forceSTSHeader: true
|
|
frameDeny: true
|
|
contentTypeNosniff: true
|
|
browserXssFilter: true
|
|
|
|
# Rate Limiting Middleware
|
|
rate-limit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 50
|
|
period: 1s
|
|
|
|
routers:
|
|
# Exists only to obtain the XMPP certificate (ejabberd on services);
|
|
# role xmpp_cert_sync pushes it there on every renewal. No traffic
|
|
# reaches it: these names point at services. The rule must not match
|
|
# asxp.io, or its higher priority would take the site over; the
|
|
# certificate still covers it through tls.domains.
|
|
xmpp-cert:
|
|
rule: "Host(`{{ xmpp_cert_main }}`)"
|
|
entryPoints: [websecure]
|
|
priority: 1
|
|
service: noop@internal
|
|
tls:
|
|
certResolver: letsencrypt
|
|
domains:
|
|
- main: {{ xmpp_cert_main }}
|
|
sans: {{ xmpp_cert_sans | to_json }}
|