diff --git a/docs/zerossl.md b/docs/zerossl.md new file mode 100644 index 0000000..cd7ff27 --- /dev/null +++ b/docs/zerossl.md @@ -0,0 +1,70 @@ +# ZeroSSL + +EasyHAProxy can issue a ZeroSSL certificate. Follow the steps below: + +## Getting the Keys from ZeroSSL + +- Login to [ZeroSSL](https://zerossl.com?fpr=byjg) +- If you don't have an account you can use our referral link: [https://zerossl.com?fpr=byjg](https://zerossl.com?fpr=byjg) +- If you created recently and would like to support us open an issue, and I'll try to add you as our referred. +- In the ZeroSSL dashboard click in 'Developer' and the Generate EAB Keys + +![zerossl_1.png](zerossl_1.png) + +- Once you generate the keys, please **take note**. We will need this later, and it isn't saved anywhere. + +![zerossl_2.png](zerossl_2.png) + +```text +Important: if you to this process again the old values will be lost and you need to setup EasyHAProxy again. +``` + +## Setting up EasyHAProxy + +Run the EasyHAProxy container with the following parameters: + +```bash +docker run \ + ... \ + -e EASYHAPROXY_CERTBOT_EMAIL="your zerossl email" \ + -e EASYHAPROXY_CERTBOT_EAB_KID="the eab_kid from the previous step" \ + -e EASYHAPROXY_CERTBOT_EAB_HMAC_KEY="the eab_hmac_key from the previous step" \ + -e EASYHAPROXY_CERTBOT_SERVER="https://acme.zerossl.com/v2/DV90" \ + -p 80:80 \ + -p 443:443 \ + -v /path/to/guest/certbot/certs:/certs/certbot \ + ... \ + byjg/easy-haproxy +``` + +Notes: + +- If you don't setup all `EASYHAPROXY_CERTBOT_*` environment variables with the proper values, EasyHAProxy will fail silently and **will not request** a certificate. +- The ports 80 and 443 needs to accessible through the internet as [Let's Encrypt requirement](https://letsencrypt.org/docs/allow-port-80/) + +**It is required you to persist the container folder `/certs/certbot` outside the container.** + +You cannot delete or change it contents. +If you do not persist, or change/delete the contents, Let's encrypt will not work properly. + + +## Setting up your container to use ZeroSSL + +```bash +docker run \ + ... \ + --label easyhaproxy.express.port=80 \ + --label easyhaproxy.express.localport=3000 \ + --label easyhaproxy.express.host=example.org \ + --label easyhaproxy.express.certbot=true \ + ... \ + some/myimage +``` + +Requirements: + +- Your container **must** listen to port 80. Letsencrypt will not issue the certificate if `easyhaproxy..port` is in another port, and EasyHAProxy will fail silently. +- You cannot set port 443 for the container with the Letsencrypt because EasyHAProxy will create this port automatically once the certificate is issued. + +---- +[Open source ByJG](http://opensource.byjg.com) diff --git a/docs/zerossl_1.png b/docs/zerossl_1.png new file mode 100644 index 0000000..06810d1 Binary files /dev/null and b/docs/zerossl_1.png differ diff --git a/docs/zerossl_2.png b/docs/zerossl_2.png new file mode 100644 index 0000000..aeb5841 Binary files /dev/null and b/docs/zerossl_2.png differ