202105

certbot x cloudflare de wildcard cert.

testuser@lab01:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.5 LTS"
testuser@lab01:~$ uname -a
Linux lab01 4.15.0-142-generic #146-Ubuntu SMP Tue Apr 13 01:11:19 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
testuser@lab01:~$
testuser@lab01:~/certbot-cloudflare$ mkdir certbot-cloudflare
testuser@lab01:~/certbot-cloudflare$ cd certbot-cloudflare
testuser@lab01:~/certbot-cloudflare$ mkdir data
testuser@lab01:~/certbot-cloudflare$ cd data
testuser@lab01:~/certbot-cloudflare/data$ echo "dns_cloudflare_email=<cloudflare_account_email>" > credentials
testuser@lab01:~/certbot-cloudflare/data$ echo "dns_cloudflare_api_key=<cloudflare_global_apikey>" >> credentials
testuser@lab01:~/certbot-cloudflare/data$ chmod 600 /root/.cloudflare/credentials
testuser@lab01:~/certbot-cloudflare/data$ cd ..
testuser@lab01:~/certbot-cloudflare$ docker run -it --rm --name certbot-cloudflare \
>             -v $PWD/data/etc:/etc/letsencrypt \
>             -v $PWD/data/var/lib:/var/lib/letsencrypt \
>             -v $PWD/data/credentials:/root/cloudflare.credentials \
>             certbot/dns-cloudflare certonly \
>             --dns-cloudflare \
>             --dns-cloudflare-credentials /root/cloudflare.credentials \
>             --dns-cloudflare-propagation-seconds 60 \
>             --email [email protected] \
>             --server https://acme-v02.api.letsencrypt.org/directory \
>             -d *.jp7fkf.dev
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-cloudflare, Installer None

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Account registered.
Requesting a certificate for *.jp7fkf.dev
Performing the following challenges:
dns-01 challenge for jp7fkf.dev
Waiting 60 seconds for DNS changes to propagate
Waiting for verification...
Cleaning up challenges
Subscribe to the EFF mailing list (email: [email protected]).

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/jp7fkf.dev/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/jp7fkf.dev/privkey.pem
   Your certificate will expire on 2021-08-15. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
  • renew
docker run -it --rm --name certbot-cloudflare \
            -v $PWD/data/etc:/etc/letsencrypt \
            -v $PWD/data/var/lib:/var/lib/letsencrypt \
            -v $PWD/data/credentials:/root/cloudflare.credentials \
            certbot/dns-cloudflare renew --dry-run

autossh on docker

version: '3'
services:
  ssh-to-docker-host:
    image: jnovack/autossh
    container_name: autossh-ssh-to-docker-host
    environment:
      - SSH_REMOTE_USER=remote_user
      - SSH_REMOTE_HOST=10.10.10.20
      - SSH_REMOTE_PORT=22
      - SSH_TARGET_HOST=10.10.10.10
      - SSH_TARGET_PORT=22
      - SSH_TUNNEL_PORT=12322
    restart: always
    volumes:
      - ~/.ssh/id_rsa:/id_rsa:ro
  • 簡易バックドア的に使える

aironetで Previous authentication no longer valid が出る