-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix certbot auto-renewal & hands-free cert creation #52
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change breaks my ability to enable TLS on my GCP VM with the error service "ropewiki_reverse_proxy" is not running container #1
upon running enable_tls.sh
(complete log below). I've confirmed that the head of master still works using the same procedure.
Also, not all sites will want to enable TLS for both the base and www domain names so we should have some setting, prompt, or other input that allows selection of just one of them. This was previously achieved by simply selecting the appropriate sites in certbot.
Following python3 deploy_tool.py gcpdev dc build
:
bjpcaltech@gcp-ropewiki-dev:~/rw/app$ python3 deploy_tool.py gcpdev create_db
2023-07-23T20:03:02.630147 Deleting/cleaning up any existing database...
2023-07-23T20:03:02.630362 RUN git log -n 1
2023-07-23T20:03:02.636009 RUN git status
2023-07-23T20:03:02.644569 SCRIPT docker compose -p gcpdev stop ropewiki_db
2023-07-23T20:03:02.644666 RUN sh /home/bjpcaltech/rw/app/docker_compose_command.sh && rm /home/bjpcaltech/rw/app/docker_compose_command.sh
2023-07-23T20:03:02.773471 SCRIPT docker compose -p gcpdev rm -v -f ropewiki_db
2023-07-23T20:03:02.773535 RUN sh /home/bjpcaltech/rw/app/docker_compose_command.sh && rm /home/bjpcaltech/rw/app/docker_compose_command.sh
No stopped containers
2023-07-23T20:03:02.861323 RUN docker volume ls
2023-07-23T20:03:02.886146 RUN docker volume rm ropewiki_database_storage
ropewiki_database_storage
2023-07-23T20:03:02.958391 SCRIPT docker compose -p gcpdev up -d ropewiki_db ropewiki_backup_manager
2023-07-23T20:03:02.958455 RUN sh /home/bjpcaltech/rw/app/docker_compose_command.sh && rm /home/bjpcaltech/rw/app/docker_compose_command.sh
[+] Building 0.0s (0/0)
[+] Running 4/4
? Network gcpdev_default Created 0.1s
? Volume "ropewiki_database_storage" Created 0.0s
? Container gcpdev-ropewiki_db-1 Started 0.6s
? Container gcpdev-ropewiki_backup_manager-1 Started 1.1s
2023-07-23T20:03:04.325934 >> Waiting for MySQL database to initialize...
2023-07-23T20:03:09.331241 RUN docker inspect --format "{{.State.Status}}" gcpdev-ropewiki_db-1
2023-07-23T20:03:09.370151 DB status: running
2023-07-23T20:03:09.370384 RUN docker container logs gcpdev-ropewiki_db-1
2023-07-23T20:03:09.402677 Ready count: 1
2023-07-23T20:03:19.412985 RUN docker inspect --format "{{.State.Status}}" gcpdev-ropewiki_db-1
2023-07-23T20:03:19.445016 DB status: running
2023-07-23T20:03:19.445181 RUN docker container logs gcpdev-ropewiki_db-1
2023-07-23T20:03:19.480146 Ready count: 2
2023-07-23T20:03:19.480402 >> Creating empty ropewiki database...
2023-07-23T20:03:19.480568 RUN docker container exec gcpdev-ropewiki_db-1 mysqladmin -u root -REDACTED create ropewiki
mysqladmin: [Warning] Using a password on the command line interface can be insecure.
2023-07-23T20:03:19.605070 >> Creating ropewiki user...
2023-07-23T20:03:19.605260 RUN docker container exec gcpdev-ropewiki_db-1 mysql -uroot -REDACTED --host ropewiki_db -e "CREATE USER 'ropewiki'@'%' IDENTIFIED BY 'REDACTED';"
mysql: [Warning] Using a password on the command line interface can be insecure.
2023-07-23T20:03:19.735449 RUN docker container exec gcpdev-ropewiki_db-1 mysql -uroot -REDACTED --host ropewiki_db -e "GRANT ALL PRIVILEGES ON * . * TO 'ropewiki'@'%';"
mysql: [Warning] Using a password on the command line interface can be insecure.
2023-07-23T20:03:19.854581 RUN docker container exec gcpdev-ropewiki_db-1 mysql -uroot -REDACTED --host ropewiki_db -e "FLUSH PRIVILEGES;"
mysql: [Warning] Using a password on the command line interface can be insecure.
2023-07-23T20:03:19.973891 RopeWiki database initialized successfully.
bjpcaltech@gcp-ropewiki-dev:~/rw/app$ python3 deploy_tool.py gcpdev restore_empty_db
Restore /home/bjpcaltech/rw/app/database/empty_schema.sql? (y/n): y
2023-07-23T20:03:37.434949 Ensuring backup manager is available...
2023-07-23T20:03:37.435182 RUN git log -n 1
2023-07-23T20:03:37.440464 RUN git status
2023-07-23T20:03:37.446203 SCRIPT docker compose -p gcpdev up -d ropewiki_backup_manager
2023-07-23T20:03:37.446368 RUN sh /home/bjpcaltech/rw/app/docker_compose_command.sh && rm /home/bjpcaltech/rw/app/docker_compose_command.sh
[+] Building 0.0s (0/0)
[+] Running 2/0
? Container gcpdev-ropewiki_db-1 Running 0.0s
? Container gcpdev-ropewiki_backup_manager-1 Running 0.0s
2023-07-23T20:03:37.561142 Loading /home/bjpcaltech/rw/app/database/empty_schema.sql...
2023-07-23T20:03:37.561329 (NOTE: this operation usually takes a few minutes)
2023-07-23T20:03:37.561453 RUN cat /home/bjpcaltech/rw/app/database/empty_schema.sql | docker container exec -i gcpdev-ropewiki_backup_manager-1 mysql -uropewiki -pREDACTED --host ropewiki_db ropewiki
mysql: [Warning] Using a password on the command line interface can be insecure.
2023-07-23T20:03:40.453900 -> Backup restored.
bjpcaltech@gcp-ropewiki-dev:~/rw/app$ python3 deploy_tool.py gcpdev enable_tls
2023-07-23T20:03:54.838925 RUN git log -n 1
2023-07-23T20:03:54.844592 RUN git status
2023-07-23T20:03:54.851163 Script generated. To enable TLS, run:
2023-07-23T20:03:54.851228 sh /home/bjpcaltech/rw/app/enable_tls.sh
bjpcaltech@gcp-ropewiki-dev:~/rw/app$ sh /home/bjpcaltech/rw/app/enable_tls.sh
service "ropewiki_reverse_proxy" is not running container #1
bjpcaltech@gcp-ropewiki-dev:~/rw/app$
Auto-renew of certificates should work now (certbot automatically sets it up in
/etc/cron.d/certbot
). All it needed was cron running in the reverse_proxy container.This PR:
cron
at startup.enable_tls
deploy command more hands-free. It'll now automatically request certificates for both$WG_HOSTNAME
andwww.$WG_HOSTNAME
without needing human input.add_cert_cronjob
which install a renewal cronjob on the VM, not inside the container (and didn't work because of Crontab for cert renewal does not work #27).