<electropositron>
Ok, so I take the javascript part and double quote everything
<electropositron>
I try this
<Ryuno-KiAndrJaen>
It stumbles upon some {}, though
<Ryuno-KiAndrJaen>
So the first few characters of the JSON would help
<ocdtrekkie>
If there's one core weakness in this ACME library, it's that having to feed it JSON objects that are different per provider, with little documentation on what they should actually look like is really irritating.
<TimMc>
Pastebin next time, please. :-) Here's one: https://bpa.st/
<electropositron>
Oh ok, sorry
<ocdtrekkie>
So you still want to be using HTTPS_PORT when not using Sandcats.
<ocdtrekkie>
PORT= is for HTTP
<ocdtrekkie>
Though I think you still need to define it.
<electropositron>
Ah ok, so how do I configure it for https ?
<ocdtrekkie>
Usually we use 6080 and then you just don't allow that through your firewall.
<ocdtrekkie>
Uncomment that HTTPS_PORT line, and sent PORT to some other not 443 port.
<ocdtrekkie>
And then restart the service, of course
<electropositron>
Oh wow, it worked ! Thanks a lot !
<TimMc>
I think most people listen on ports 6080 and 6443 and use port-forwarding so that external 443 goes to the service's 6443.
<TimMc>
\o/
<TimMc>
(or use nginx listening port 443, proxying to sandstorm 6080)
<electropositron>
I tried this through nginx, but apps didin't launched
<electropositron>
the wildcard wasn't supported i guess
<ocdtrekkie>
There's a way to do it but it's complicated. If you're able to let Sandstorm handle it's own HTTPS now it's preferable, we just have poor documentation for it because it was done more recently than much of the rest of the software.
<ocdtrekkie>
Glad we were able to sort it out for you!
<TimMc>
I haven't been following that -- it sounds like Sandstorm knows how to negotiate dns-01 with some set of DNS providers now?
<ocdtrekkie>
Yeah, using the ACME.js libraru
<ocdtrekkie>
library*
<TimMc>
nice
<TimMc>
I use NearlyFreeSpeech.net as a registrar and DNS provider and so I ended up writing my own dns-01 manual-auth-hook for certbot. I should see if there's a way to contribute that script to a library.
<TimMc>
If ACME.js could support NFSN directly, then I could pass-through the TLS stream in nginx and remove a bunch of code. :-)
<ocdtrekkie>
The plugin format for ACME.js is pretty straightforward I think, a couple of people have added their own provider plugins for it to Sandstorm.
<ocdtrekkie>
(Check About, we list the non-upstream plugins separately, and the Sandcats provider is also a plugin for ACME.js)
electropositron has quit [Quit: Connection closed]
<TimMc>
At one point I used a thoroughly ridiculous method to get Let's Encrypt working with my XMPP server, which can't handle the easier challenge methods. I generated a key and CSR on the home server, copied the CSR to my web server (of the same domain), and configured an ACME client to periodically get certs and put them in a public directory; then I had a cron job periodically curl the certs and register
<TimMc>
them with the XMPP server.
<ocdtrekkie>
I mean for a lot of enterprise stuff these days that'd be what you need if you want ACME support. :P
<TimMc>
Yeah. I'm glad the CSR mechanism exists. It allowed me to split the mechanism onto two servers in a secure way.
<TimMc>
It's just a Bit Much, is all.
<TimMc>
The alternative was dns-01, and I don't like having to provision all my servers with an API key that has complete control over my DNS records. :-/
<ocdtrekkie>
It'd be nice if everyone who supported API keys also let you create them with granular access.
<TimMc>
Relatedly, GitHub is *finally* rolling out fine-grained personal access tokens.
<ocdtrekkie>
Yeah. Cloudflare has them now too, for a while theirs was "all of your accounts" wide.
<TimMc>
oof
strugee_ has joined #sandstorm
<ocdtrekkie>
I might need to remove the double NAT configuration here at home.
<ocdtrekkie>
I got away with it for a surprisingly long time, but hairpinning isn't working on my new modem they just put in.
<ocdtrekkie>
My firewall should have no problem with it but since it doesn't see the public IP it doesn't know it needs to be hairpinned, but I think if I put the modem in bridge mode it would probably work.
<ocdtrekkie>
Right now my Sandstorm server works from the Internet, and from my internal network (where I have my own DNS), but from my Wi-Fi network which is a separate VLAN things aren't making it out and back.
garrison has quit [Read error: Connection reset by peer]