3a5f82267b
As described here ( https://github.com/matrix-org/synapse/issues/2438#issuecomment-327424711 ), using own SSL certificates for the federation port is more fragile, as renewing them could cause federation outages. The recommended setup is to use the self-signed certificates generated by Synapse. On the 443 port (matrix-nginx-proxy) side, we still use the Let's Encrypt certificates, which ensures API consumers work without having to trust "our own CA". Having done this, we also don't need to ever restart Synapse anymore, as no new SSL certificates need to be applied there. It's just matrix-nginx-proxy that needs to be restarted, and it doesn't even need a full restart as an "nginx reload" does the job of swithing to the new SSL certificates.
25 lines
1.3 KiB
Django/Jinja
25 lines
1.3 KiB
Django/Jinja
MAILTO="{{ matrix_ssl_support_email }}"
|
|
|
|
# The goal of this cronjob is to ask acmetool to check
|
|
# the current SSL certificates and to see if some need renewal.
|
|
# If so, it would attempt to renew.
|
|
#
|
|
# Various services depend on these certificates and would need to be restarted.
|
|
# This is not our concern here. We simply make sure the certificates are up to date.
|
|
# Restarting of services happens on its own different schedule (other cronjobs).
|
|
#
|
|
#
|
|
# How renewal works?
|
|
#
|
|
# acmetool will fail to bind to port :80 (because matrix-nginx-proxy or some other server is running there),
|
|
# and will fall back to its "webroot" validation method.
|
|
#
|
|
# Thus, it would put validation files in `/var/run/acme/acme-challenge`.
|
|
# These files can be retrieved via any vhost on port 80 of matrix-nginx-proxy,
|
|
# because it aliases `/.well-known/acme-challenge` to that same directory.
|
|
#
|
|
# When a custom proxy server (not matrix-nginx-proxy provided by this playbook),
|
|
# you'd need to make sure you alias these files correctly or SSL renewal would not work.
|
|
|
|
15 4 */5 * * root /usr/bin/docker run --rm --name acmetool-host-grab --net=host -v {{ matrix_ssl_certs_path }}:/certs -v {{ matrix_ssl_certs_path }}/run:/var/run/acme -e ACME_EMAIL={{ matrix_ssl_support_email }} willwill/acme-docker acmetool --batch reconcile # --xlog.severity=debug
|