Add Let's Encrypt support to emma's HAProxy

crest commented

2020-10-21 09:11:31 -05:00

Owner

FreeBSD's HAProxy package lacks LUA support so we have to use an external ACME implementation. I decided to use acme.sh because it is extensible and has few dependencies (just bash, socat and openssl).

The setup looks like this:

HAProxy binds port 80/TCP.
It matches on the ACME well known prefix and redirects ACME requests to 127.0.0.1:8080
acme.sh responds to the challenges on behalf of HAProxy.

FreeBSD's HAProxy package lacks LUA support so we have to use an external ACME implementation. I decided to use `acme.sh` because it is extensible and has few dependencies (just bash, socat and openssl). The setup looks like this: * HAProxy binds port 80/TCP. * It matches on the ACME well known prefix and redirects ACME requests to 127.0.0.1:8080 * `acme.sh` responds to the challenges on behalf of HAProxy.

crest referenced this issue from a commit

2020-10-21 09:12:17 -05:00

Add Let's Encrypt support to HAProxy. Closes #13

crest closed this issue

2020-10-21 09:12:17 -05:00

crest self-assigned this 2020-10-21 09:12:30 -05:00

genofire commented

2020-10-23 02:33:52 -05:00

Owner

On the VMs (nextcloud) we use already dehydranted ... should we use one solution everywhere?

crest commented

2020-10-23 12:01:14 -05:00

Author

Owner

The problem with dehydrated is that it doesn't work without a real HTTP server because answers the ACME challenges by letting the HTTP service serve them for it. HAProxy ist just a proxy and requires the ACME client to speak HTTP itself. Due to these constraints we can't use dehydrated with HAProxy without installing a HTTP server as well.

I see no pressing reason to standardize on one ACME implementation.

The problem with dehydrated is that it doesn't work without a real HTTP server because answers the ACME challenges by letting the HTTP service serve them for it. HAProxy ist just a proxy and requires the ACME client to speak HTTP itself. Due to these constraints we can't use dehydrated with HAProxy without installing a HTTP server as well. I see no pressing reason to standardize on one ACME implementation.

Add Let's Encrypt support to emma's HAProxy #13