آموزش HAProxy و Let’s Encrypt با تمدید امن گواهی

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

set -eu
case '/srv/academy-haproxy-tls' in /*) ;; *) printf '%s\n' 'Use a new absolute path'; exit 1;; esac
cat /etc/os-release
ps -p 1 -o comm=
test "$(ps -p 1 -o comm=)" = systemd
ip -br address
sudo ss -lntup
test ! -e '/srv/academy-haproxy-tls'
test ! -L '/srv/academy-haproxy-tls'
test ! -e /etc/haproxy
test ! -e /etc/letsencrypt
for name in academy-haproxy academy-acme-webroot academy-certbot; do
  test ! -e "/etc/systemd/system/$name.service"
done
test ! -e /etc/systemd/system/academy-certbot.timer

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

set -eu
. /etc/os-release
test "$VERSION_CODENAME" = 'noble'
sudo apt-get update
apt-cache policy haproxy certbot python3
sudo apt-get install --no-install-recommends haproxy certbot python3 openssl ca-certificates curl dnsutils nano
sudo systemctl disable --now haproxy.service certbot.timer
haproxy -vv
certbot --version
python3 --version

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

set -eu
case '/srv/academy-haproxy-tls' in /*) ;; *) printf '%s\n' 'Use a new absolute path'; exit 1;; esac
test ! -e '/srv/academy-haproxy-tls'
test ! -L '/srv/academy-haproxy-tls'
sudo install -d -m 0755 '/srv/academy-haproxy-tls'
sudo install -d -m 0755 '/srv/academy-haproxy-tls/webroot/.well-known/acme-challenge'
sudo install -d -m 0700 '/srv/academy-haproxy-tls/certs' '/srv/academy-haproxy-tls/acme'
for dir in config work logs staging-config staging-work staging-logs; do
  sudo install -d -m 0700 "/srv/academy-haproxy-tls/acme/$dir"
done

Bash روی VM اختصاصی؛ مورد بیرونی در متن مشخص است

set -eu
test ! -e '/srv/academy-haproxy-tls/haproxy.cfg'
test ! -L '/srv/academy-haproxy-tls/haproxy.cfg'
sudo install -m 0644 /dev/null '/srv/academy-haproxy-tls/haproxy.cfg'
test ! -e /etc/systemd/system/academy-haproxy.service
test ! -L /etc/systemd/system/academy-haproxy.service
sudo install -m 0644 /dev/null /etc/systemd/system/academy-haproxy.service
test ! -e /etc/systemd/system/academy-acme-webroot.service
test ! -L /etc/systemd/system/academy-acme-webroot.service
sudo install -m 0644 /dev/null /etc/systemd/system/academy-acme-webroot.service
sudo nano '/srv/academy-haproxy-tls/haproxy.cfg' /etc/systemd/system/academy-haproxy.service /etc/systemd/system/academy-acme-webroot.service

فایل روی VM اختصاصی

global
  log stdout format raw local0
  user haproxy
  group haproxy
  ssl-default-bind-options ssl-min-ver TLSv1.2

defaults
  log global
  mode http
  option httplog
  timeout connect 5s
  timeout client 30s
  timeout server 30s
  timeout http-request 10s

frontend public_http
  bind 192.0.2.10:80
  acl known_host hdr(host) -i app.example.com app.example.com:80
  http-request deny deny_status 421 unless known_host
  acl acme_path path_beg /.well-known/acme-challenge/
  http-request redirect prefix https://app.example.com code 308 unless acme_path
  use_backend acme_webroot if acme_path

backend acme_webroot
  server challenge 127.0.0.1:8888 check

فایل روی VM اختصاصی

[Unit]
Description=Academy isolated HAProxy listener
After=network-online.target academy-acme-webroot.service
Wants=network-online.target

[Service]
Type=notify
ExecStart=/usr/sbin/haproxy -Ws -f /srv/academy-haproxy-tls/haproxy.cfg -p /srv/academy-haproxy-tls/haproxy.pid
ExecReload=/usr/sbin/haproxy -c -f /srv/academy-haproxy-tls/haproxy.cfg
ExecReload=/bin/kill -USR2 $MAINPID
KillMode=mixed
Restart=on-failure

[Install]
WantedBy=multi-user.target

فایل روی VM اختصاصی

[Unit]
Description=Academy HTTP-01 static webroot
After=network.target

[Service]
User=www-data
Group=www-data
ExecStart=/usr/bin/python3 -m http.server 8888 --bind 127.0.0.1 --directory /srv/academy-haproxy-tls/webroot
Restart=on-failure
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true

[Install]
WantedBy=multi-user.target