آموزش HAProxy و Let’s Encrypt با تمدید امن گواهی

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

set -euo pipefailo pipefail
sudo systemctl daemon-reload
sudo systemctl enable academy-haproxy.service academy-acme-webroot.service
sudo systemctl enable --now academy-certbot.timer
sudo systemctl list-timers --all academy-certbot.timer
sudo journalctl -u academy-certbot.service -n 60 --no-pager
openssl s_client -connect 'app.example.com:443' -servername 'app.example.com' -verify_hostname 'app.example.com' -verify_return_error -CApath /etc/ssl/certs </dev/null 2>/dev/null | openssl x509 -noout -dates -fingerprint -sha256

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

sudo haproxy -c -f '/srv/academy-haproxy-tls/haproxy.cfg'
sudo journalctl -u academy-haproxy.service -u academy-acme-webroot.service -u academy-certbot.service -n 100 --no-pager
sudo ss -lntp
sudo stat -c '%a %U:%G %n' '/srv/academy-haproxy-tls/certs' '/srv/academy-haproxy-tls/certs/app.example.com.pem'
curl --fail -H 'Host: app.example.com' 'http://10.77.0.21:8080/health/ready'
curl --fail -H 'Host: app.example.com' 'http://10.77.0.22:8080/health/ready'
dig CAA 'app.example.com'

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

set -eu
sudo systemctl stop academy-certbot.timer
sudo openssl x509 -in '/srv/academy-haproxy-tls/certs/app.example.com.previous.pem' -checkend 86400 -checkhost 'app.example.com' -noout
sudo install -m 0600 '/srv/academy-haproxy-tls/certs/app.example.com.previous.pem' '/srv/academy-haproxy-tls/certs/rollback.pem'
sudo python3 - <<'PY'
from pathlib import Path
root=Path('/srv/academy-haproxy-tls')
s=(root/'haproxy.cfg').read_text()
old=str(root/'certs/app.example.com.pem')
assert s.count('crt '+old)==1
(root/'rollback.cfg').write_text(s.replace('crt '+old,'crt '+str(root/'certs/rollback.pem')))
PY
sudo haproxy -c -f '/srv/academy-haproxy-tls/rollback.cfg'
sudo mv '/srv/academy-haproxy-tls/certs/rollback.pem' '/srv/academy-haproxy-tls/certs/app.example.com.pem'
sudo haproxy -c -f '/srv/academy-haproxy-tls/haproxy.cfg'
sudo systemctl reload academy-haproxy.service
curl --fail --show-error 'https://app.example.com/'

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

set -eu
sudo haproxy -c -f '/srv/academy-haproxy-tls/haproxy.bootstrap.cfg'
sudo install -m 0644 '/srv/academy-haproxy-tls/haproxy.bootstrap.cfg' '/srv/academy-haproxy-tls/haproxy.cfg.next'
sudo mv '/srv/academy-haproxy-tls/haproxy.cfg.next' '/srv/academy-haproxy-tls/haproxy.cfg'
sudo systemctl reload academy-haproxy.service
curl --fail --resolve 'app.example.com:80:192.0.2.10' 'http://app.example.com/.well-known/acme-challenge/academy-probe'