Sergei Poljanski
cf142c6e3b
Some checks failed
deploy / ansible (push) Failing after 59s
Traefik never requests a certificate for a name it already holds one for, so the XMPP certificate came out without asxp.io, the XMPP domain itself. ejabberd picks the matching certificate file per domain, so push two: the site's asxp.io certificate and xmpp.asxp.io + conference. The receiver takes the name from the SSH command (asxp.io or a subdomain), checks the certificate matches it, and retires the hand-made server.pem once both files are in place. A second probe on 5223 sends SNI asxp.io, as clients do, and the outdated-certificate alert compares each served certificate with its source in acme.json. Assisted-by: Claude:opus-5-5
13 lines
686 B
YAML
13 lines
686 B
YAML
---
|
|
# The XMPP certificate is issued by Traefik on asxpio-ops (HTTP challenge;
|
|
# services forwards its challenges there, role acme_forward) and pushed to
|
|
# ejabberd on asxpio-services on every renewal (role xmpp_cert_sync).
|
|
xmpp_cert_main: xmpp.asxp.io
|
|
xmpp_cert_sans: [conference.asxp.io]
|
|
# Certificates pushed to ejabberd, by their main domain in acme.json; it
|
|
# picks the matching file per domain. asxp.io is the site's own
|
|
# certificate: Traefik never requests a name it already holds a
|
|
# certificate for, so asxp.io can't be part of the one above.
|
|
xmpp_cert_push: [asxp.io, xmpp.asxp.io]
|
|
# renovate: datasource=docker depName=nginx
|
|
acme_forward_nginx_version: "1.31.8-alpine-slim"
|