Sergei Poljanski
cf142c6e3b
Some checks failed
deploy / ansible (push) Failing after 59s
Traefik never requests a certificate for a name it already holds one for, so the XMPP certificate came out without asxp.io, the XMPP domain itself. ejabberd picks the matching certificate file per domain, so push two: the site's asxp.io certificate and xmpp.asxp.io + conference. The receiver takes the name from the SSH command (asxp.io or a subdomain), checks the certificate matches it, and retires the hand-made server.pem once both files are in place. A second probe on 5223 sends SNI asxp.io, as clients do, and the outdated-certificate alert compares each served certificate with its source in acme.json. Assisted-by: Claude:opus-5-5
38 lines
1 KiB
Django/Jinja
38 lines
1 KiB
Django/Jinja
# Traefik Dynamic Configuration
|
|
|
|
http:
|
|
middlewares:
|
|
# Security Headers Middleware
|
|
secure-headers:
|
|
headers:
|
|
sslRedirect: true
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
forceSTSHeader: true
|
|
frameDeny: true
|
|
contentTypeNosniff: true
|
|
browserXssFilter: true
|
|
|
|
# Rate Limiting Middleware
|
|
rate-limit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 50
|
|
period: 1s
|
|
|
|
routers:
|
|
# Exists only to obtain the XMPP certificate (ejabberd on services);
|
|
# role xmpp_cert_sync pushes it there on every renewal. No traffic
|
|
# reaches it: these names point at services. asxp.io is pushed from
|
|
# the site's own certificate.
|
|
xmpp-cert:
|
|
rule: "Host(`{{ xmpp_cert_main }}`)"
|
|
entryPoints: [websecure]
|
|
priority: 1
|
|
service: noop@internal
|
|
tls:
|
|
certResolver: letsencrypt
|
|
domains:
|
|
- main: {{ xmpp_cert_main }}
|
|
sans: {{ xmpp_cert_sans | to_json }}
|