165 lines
5.5 KiB
ReStructuredText
165 lines
5.5 KiB
ReStructuredText
.. _full_server_setup
|
|
Full server setup
|
|
=================
|
|
|
|
This document describes how to set up a server running HAProxy with certbot and
|
|
the certbot-haproxy plugin. The installation below assumes you are running
|
|
Debian Jessie but it should be almost entirely the same process on Ubuntu.
|
|
|
|
First add the backports repo for Jessie to your apt sources.
|
|
|
|
.. note::
|
|
|
|
This will not work for Ubuntu, you will need to use another source,
|
|
check which version comes with your version of Ubuntu, if it is a version
|
|
below 0.8, you need to find a back port PPA or download certbot from source.
|
|
|
|
.. code:: bash
|
|
|
|
echo "deb http://ftp.debian.org/debian jessie-backports main" >> \
|
|
/etc/apt/sources.list.d/jessie-backports.list
|
|
|
|
Now update, upgrade and install some requirements:
|
|
|
|
- **Some utilities:** ``sudo`` ``tcpdump`` ``ufw`` ``git`` ``curl`` ``wget``
|
|
- **OpenSSL and CA certificates:** ``openssl`` ``ca-certificates``
|
|
- **Build dependencies:** ``build-essential`` ``libffi-dev`` ``libssl-dev`` ``python-dev``
|
|
- **Python and related:** ``python`` ``python-setuptools``
|
|
- **HAProxy:** ``haproxy``
|
|
- **Python dependency managing:** ``pip``
|
|
|
|
.. code:: bash
|
|
|
|
apt-get update
|
|
apt-get upgrade -y
|
|
apt-get install -y \
|
|
sudo tcpdump ufw git curl wget \
|
|
openssl ca-certificates \
|
|
build-essential libffi-dev libssl-dev python-dev \
|
|
python python-setuptools \
|
|
haproxy
|
|
|
|
easy_install pip
|
|
pip install --upgrade setuptools
|
|
|
|
We also installed a simple firewall above, but it is not yet configured, let's
|
|
do that now:
|
|
|
|
.. code:: bash
|
|
|
|
ufw allow ssh
|
|
ufw allow http
|
|
ufw allow https
|
|
ufw default deny incoming
|
|
ufw --force enable
|
|
|
|
.. warning::
|
|
|
|
You probably want a little more protection for a production proxy
|
|
than just this simple firewall, but it's out of the scope of this readme.
|
|
|
|
Now that we have all dependencies, it's time to start a process that may take
|
|
quite some time to complete. HAProxy comes with a DH parameters file that is
|
|
considered weak. We need to generate a new dhparams.pem file with a prime of at
|
|
least ``2048`` bit length, you can also opt for ``3072`` or ``4096``. This can
|
|
take hours on lower specification hardware, but will still take minutes on
|
|
faster hardware, especially with ``4096`` bit primes. Run this is in a separate
|
|
ssh session or use ``screen`` of ``tmux`` to allow this to run in the
|
|
background.
|
|
|
|
.. code:: bash
|
|
|
|
openssl dhparam -out /opt/certbot/dhparams.pem 2048
|
|
|
|
Now set a hostname.
|
|
|
|
.. code:: bash
|
|
|
|
echo "[INSERT YOUR HOSTNAME HERE]" > /etc/hostname
|
|
hostname -F /etc/hostname
|
|
|
|
Run as unprivileged user
|
|
++++++++++++++++++++++++
|
|
|
|
If you want to run Certbot in an unprivileged mode, keep reading, otherwise,
|
|
skip to the installation of Certbot.
|
|
|
|
Certbot normally requires access to the ``/etc/`` directory, which is owned by
|
|
root and therefore, Certbot needs to run as root. However, we don't like it
|
|
when processes run as root, most especially when they are opening ports on a
|
|
public network interface..
|
|
|
|
In order to let Certbot run as an unprivileged user, we will:
|
|
|
|
- Create a ``certbot`` user with a home directory on the system so the
|
|
automatic renewal of certificates can be run by this user.
|
|
- Tell Certbot that the working directories are located in ``certbot``'s home
|
|
directory.
|
|
- Optionally: add your own user account to the Certbot user's group so you can
|
|
run Certbot manually.
|
|
- Allow HAProxy to access the certificates that are generated by Certbot.
|
|
- Allow the certbot user to restart the HAProxy server.
|
|
|
|
Lastly, to do automatic renewal of certificates, we will create a systemd timer
|
|
and a service to start at every boot and every 12 hours, at a random time off
|
|
the day, in order to not collectively DDOS Let's Encrypts service.
|
|
|
|
.. code:: bash
|
|
|
|
useradd -s /bin/bash -m -d /opt/certbot certbot
|
|
usermod -a -G certbot haproxy # Allow HAProxy access to the certbot certs
|
|
mkdir -p /opt/certbot/logs
|
|
mkdir -p /opt/certbot/config
|
|
mkdir -p /opt/certbot/.config/letsencrypt
|
|
|
|
If you need to use Certbot from your user account, or if you have a daemon
|
|
running on your proxy server, that configures domains on your proxy, e.g.: in a
|
|
web hosting environment - you can add those users to the ``certbot`` group.
|
|
|
|
.. code:: bash
|
|
|
|
usermod -a -G certbot [ADD YOUR USER HERE]
|
|
|
|
You will also need to tell your user what the working directory of your Certbot
|
|
setup is (``/opt/certbot/``). Certbot allows you to create a configuration file
|
|
with default settings in the users' home dir:
|
|
``opt/certbot/.config/letsencrypt/cli.ini``.
|
|
|
|
Besides the working directory.
|
|
|
|
.. code:: bash
|
|
|
|
mkdir -p /opt/certbot/.config/letsencrypt
|
|
cat <<EOF > /opt/certbot/.config/letsencrypt/cli.ini
|
|
work-dir=/opt/certbot/
|
|
logs-dir=/opt/certbot/logs/
|
|
config-dir=/opt/certbot/config
|
|
EOF
|
|
|
|
Next time you run Certbot, it will use our new working directory.
|
|
|
|
Now to allow the certbot user to restart HAProxy, put the following in the
|
|
sudoers file:
|
|
|
|
.. code:: bash
|
|
|
|
cat <<EOF >> /etc/sudoers
|
|
%certbot ALL=NOPASSWD: /bin/systemctl restart haproxy
|
|
EOF
|
|
|
|
Installing certbot-haproxy
|
|
++++++++++++++++++++++++++
|
|
|
|
Now we haven't done one very essential thing yet, install ``certbot-haproxy``.
|
|
Since our plugin is in an alpha stage, we did not package it yet. You will need
|
|
to get it from our Gitlab server.
|
|
|
|
.. code:: bash
|
|
|
|
git clone https://code.greenhost.net/open/certbot-haproxy.git
|
|
cd ./certbot-haproxy/
|
|
sudo pip install ./
|
|
|
|
Continue reading `</README.rst>`_ after the quick installation instructions, at
|
|
:ref:`haproxy_config`
|