Sergei Poljanski
cf142c6e3b
Some checks failed
deploy / ansible (push) Failing after 59s
Traefik never requests a certificate for a name it already holds one for, so the XMPP certificate came out without asxp.io, the XMPP domain itself. ejabberd picks the matching certificate file per domain, so push two: the site's asxp.io certificate and xmpp.asxp.io + conference. The receiver takes the name from the SSH command (asxp.io or a subdomain), checks the certificate matches it, and retires the hand-made server.pem once both files are in place. A second probe on 5223 sends SNI asxp.io, as clients do, and the outdated-certificate alert compares each served certificate with its source in acme.json. Assisted-by: Claude:opus-5-5
35 lines
814 B
Django/Jinja
35 lines
814 B
Django/Jinja
# Managed by Ansible (role monitoring).
|
|
modules:
|
|
http_2xx:
|
|
prober: http
|
|
timeout: 10s
|
|
http:
|
|
preferred_ip_protocol: ip4
|
|
follow_redirects: true
|
|
# Up means "answers": 401/403/404 are fine (s3 root, allowlisted UIs)
|
|
http_up:
|
|
prober: http
|
|
timeout: 10s
|
|
http:
|
|
preferred_ip_protocol: ip4
|
|
valid_status_codes: [200, 301, 302, 401, 403, 404]
|
|
tls_connect:
|
|
prober: tcp
|
|
timeout: 10s
|
|
tcp:
|
|
preferred_ip_protocol: ip4
|
|
tls: true
|
|
# XMPP clients name the XMPP domain (asxp.io), not the SRV host, in SNI
|
|
tls_connect_asxpio:
|
|
prober: tcp
|
|
timeout: 10s
|
|
tcp:
|
|
preferred_ip_protocol: ip4
|
|
tls: true
|
|
tls_config:
|
|
server_name: asxp.io
|
|
tcp_connect:
|
|
prober: tcp
|
|
timeout: 10s
|
|
tcp:
|
|
preferred_ip_protocol: ip4
|