ChanServ changed the topic of #sandstorm to: Welcome to #sandstorm: home of all things Sandstorm and Cap'n Proto. Say hi! | Have a question but no one is here? Try asking in the discussion group: https://groups.google.com/group/sandstorm-dev | Channel logs available at https://libera.irclog.whitequark.org/sandstorm
mnutt has joined #sandstorm
mnutt has quit [Ping timeout: 268 seconds]
mnutt has joined #sandstorm
mnutt has quit [Remote host closed the connection]
mnutt has joined #sandstorm
mnutt has quit [Ping timeout: 248 seconds]
mnutt has joined #sandstorm
mnutt has quit [Remote host closed the connection]
mnutt has joined #sandstorm
yarmo has quit [Quit: yarmo]
mnutt has quit [Remote host closed the connection]
mnutt has joined #sandstorm
yarmo has joined #sandstorm
strugee_ has quit [Ping timeout: 248 seconds]
larjona has joined #sandstorm
larjona has quit [Client Quit]
larjona has joined #sandstorm
larjona has quit [Quit: http://quassel-irc.org - Chatee cómodamente donde sea.]
larjona has joined #sandstorm
kentonv has quit [Ping timeout: 255 seconds]
kentonv has joined #sandstorm
garrison has quit [Read error: Connection reset by peer]
garrison has joined #sandstorm
Kalle[m] has quit [Quit: You have been kicked for being idle]
garrison has quit [Read error: Connection reset by peer]
garrison has joined #sandstorm
garrison has quit [Read error: Connection reset by peer]
garrison has joined #sandstorm
electropositron has joined #sandstorm
<electropositron> Hi everyone ! I am looking for help on Sandstorm with the SSL certification process.
<electropositron> Where could I find an exemple of JSON request to send from the admin panel for the ACME DNS-01 challenge ?
<electropositron> Thanks in advance !
koo5__ has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
<ocdtrekkie> which DNS provider are you using?
koo5__ has joined #sandstorm
<electropositron> Gandi
<ocdtrekkie> I suspect it looks like this: {
<ocdtrekkie> baseUrl: 'https://dns.api.gandi.net/api/v5/', // default
<ocdtrekkie> token: 'xxxx'
<ocdtrekkie> }
<ocdtrekkie> https://git.coolaj86.com/coolaj86/acme-dns-01-gandi.js.git is the Gandi plugin documentation.
koo5__ has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
<ocdtrekkie> token, or course, being a production API key from your Gandi panel
koo5__ has joined #sandstorm
<electropositron> Thanks, I'm trying this right away !
<electropositron> Ok, I'm getting an error
<electropositron> Invalid JSON: Expected property name or '}' in JSON at position 2
<ocdtrekkie> I would probably removed the // default comment in there, perhaps?
<electropositron> Same error...
<electropositron> That's why I wandered about JSON formatting
<Ryuno-KiAndrJaen> JSON also requires double quotes
<electropositron> I didn't understood the exemples linked from sandstorm's documentation :
<electropositron> Ok, so I take the javascript part and double quote everything
<electropositron> I try this
<Ryuno-KiAndrJaen> It stumbles upon some {}, though
<Ryuno-KiAndrJaen> So the first few characters of the JSON would help
<ocdtrekkie> If there's one core weakness in this ACME library, it's that having to feed it JSON objects that are different per provider, with little documentation on what they should actually look like is really irritating.
<electropositron> Good news ! It worked ! With
<electropositron> {
<electropositron>  "baseUrl": "https://dns.api.gandi.net/api/v5/",
<electropositron>  "token": "xxxx"
<electropositron> }
<electropositron> Thanks a lot for your help !!
<Ryuno-KiAndrJaen> You're welcome
<ocdtrekkie> Awesome. Knew we had to be close!
garrison has quit [Read error: Connection reset by peer]
garrison has joined #sandstorm
<ocdtrekkie> We probably should at some point have our own in-house documentation page for those.
electropositron has quit [Quit: Connection closed]
electropositron has joined #sandstorm
<electropositron> Hi again, it seems my sandstorm installation is down now :'(
<electropositron> Once the ACME challenge is completed, I changed the sansdstorm listening port to 443 in /opt/snadstorm/sandstorm.conf
<electropositron> relaunched sandstorm process
<electropositron> But connection is refused due to ssl error
<electropositron> Is there Trouble shooting guide for this...
<electropositron> Is there a way to manage sll connection on command line perhaps ?
<ocdtrekkie> There is, though a port change shouldn't affect your certificate being valid... 🤔
<ocdtrekkie> what does your sandstorm.conf look like? you can change values a bit if needbe
<electropositron> Here is my /opt/sandstorm/sandstorm.conf
<electropositron> SERVER_USER=sandstorm
<electropositron> PORT=443
<electropositron> MONGO_PORT=6081
<electropositron> BIND_IP=0.0.0.0
<electropositron> #BASE_URL=https://charbon.sandcats.io
<electropositron> #WILDCARD_HOST=*.charbon.sandcats.io
<electropositron> BASE_URL=https://charbon.hopstudio.fr
<electropositron> WILDCARD_HOST=*.hopstudio.fr
<electropositron> UPDATE_CHANNEL=dev
<electropositron> ALLOW_DEV_ACCOUNTS=false
<electropositron> SMTP_LISTEN_PORT=25
<electropositron> #SANDCATS_BASE_DOMAIN=sandcats.io
<electropositron> #HTTPS_PORT=443
<electropositron> sudo sandstorm renew-certificate
<electropositron> get a successful result
<TimMc> Pastebin next time, please. :-) Here's one: https://bpa.st/
<electropositron> Oh ok, sorry
<ocdtrekkie> So you still want to be using HTTPS_PORT when not using Sandcats.
<ocdtrekkie> PORT= is for HTTP
<ocdtrekkie> Though I think you still need to define it.
<electropositron> Ah ok, so how do I configure it for https ?
<ocdtrekkie> Usually we use 6080 and then you just don't allow that through your firewall.
<ocdtrekkie> Uncomment that HTTPS_PORT line, and sent PORT to some other not 443 port.
<ocdtrekkie> And then restart the service, of course
<electropositron> Oh wow, it worked ! Thanks a lot !
<TimMc> I think most people listen on ports 6080 and 6443 and use port-forwarding so that external 443 goes to the service's 6443.
<TimMc> \o/
<TimMc> (or use nginx listening port 443, proxying to sandstorm 6080)
<electropositron> I tried this through nginx, but apps didin't launched
<electropositron> the wildcard wasn't supported i guess
<ocdtrekkie> There's a way to do it but it's complicated. If you're able to let Sandstorm handle it's own HTTPS now it's preferable, we just have poor documentation for it because it was done more recently than much of the rest of the software.
<ocdtrekkie> Glad we were able to sort it out for you!
<TimMc> I haven't been following that -- it sounds like Sandstorm knows how to negotiate dns-01 with some set of DNS providers now?
<ocdtrekkie> Yeah, using the ACME.js libraru
<ocdtrekkie> library*
<TimMc> nice
<TimMc> I use NearlyFreeSpeech.net as a registrar and DNS provider and so I ended up writing my own dns-01 manual-auth-hook for certbot. I should see if there's a way to contribute that script to a library.
<TimMc> If ACME.js could support NFSN directly, then I could pass-through the TLS stream in nginx and remove a bunch of code. :-)
<ocdtrekkie> The plugin format for ACME.js is pretty straightforward I think, a couple of people have added their own provider plugins for it to Sandstorm.
<ocdtrekkie> (Check About, we list the non-upstream plugins separately, and the Sandcats provider is also a plugin for ACME.js)
electropositron has quit [Quit: Connection closed]
<TimMc> At one point I used a thoroughly ridiculous method to get Let's Encrypt working with my XMPP server, which can't handle the easier challenge methods. I generated a key and CSR on the home server, copied the CSR to my web server (of the same domain), and configured an ACME client to periodically get certs and put them in a public directory; then I had a cron job periodically curl the certs and register
<TimMc> them with the XMPP server.
<ocdtrekkie> I mean for a lot of enterprise stuff these days that'd be what you need if you want ACME support. :P
<TimMc> Yeah. I'm glad the CSR mechanism exists. It allowed me to split the mechanism onto two servers in a secure way.
<TimMc> It's just a Bit Much, is all.
<TimMc> The alternative was dns-01, and I don't like having to provision all my servers with an API key that has complete control over my DNS records. :-/
<ocdtrekkie> It'd be nice if everyone who supported API keys also let you create them with granular access.
<TimMc> Relatedly, GitHub is *finally* rolling out fine-grained personal access tokens.
<ocdtrekkie> Yeah. Cloudflare has them now too, for a while theirs was "all of your accounts" wide.
<TimMc> oof
strugee_ has joined #sandstorm
<ocdtrekkie> I might need to remove the double NAT configuration here at home.
<ocdtrekkie> I got away with it for a surprisingly long time, but hairpinning isn't working on my new modem they just put in.
<ocdtrekkie> My firewall should have no problem with it but since it doesn't see the public IP it doesn't know it needs to be hairpinned, but I think if I put the modem in bridge mode it would probably work.
<ocdtrekkie> Right now my Sandstorm server works from the Internet, and from my internal network (where I have my own DNS), but from my Wi-Fi network which is a separate VLAN things aren't making it out and back.
garrison has quit [Read error: Connection reset by peer]
garrison has joined #sandstorm
rektide_ is now known as rektide
drkokandy has quit [Ping timeout: 255 seconds]
strugee_ has quit [Ping timeout: 248 seconds]