45 lines
1.4 KiB
Markdown
45 lines
1.4 KiB
Markdown
# Staging reverse proxy
|
|
|
|
`whoneedhelp.imalto.site.conf` is the HTTP vhost consumed by Certbot's Nginx
|
|
installer on the VPN gateway. It forwards HTTP and LiveView WebSocket traffic
|
|
to the workstation at `10.8.0.14:4010`.
|
|
|
|
The workstation's ignored `.env` must use:
|
|
|
|
```dotenv
|
|
PHX_HOST=whoneedhelp.imalto.site
|
|
PHX_SCHEME=https
|
|
PHX_URL_PORT=443
|
|
TRAEFIK_TRUSTED_IPS=10.8.0.1/32
|
|
```
|
|
|
|
The last setting allows forwarded headers only from the observed VPN address of
|
|
the gateway. Do not replace it with Traefik's insecure forwarded-header mode.
|
|
|
|
The checked server currently uses the standard Ubuntu Nginx/Certbot layout.
|
|
After copying the vhost to `/home/simple/whoneedhelp.imalto.site.conf`, install
|
|
and enable it with root privileges:
|
|
|
|
```bash
|
|
sudo install -o root -g root -m 0644 \
|
|
/home/simple/whoneedhelp.imalto.site.conf \
|
|
/etc/nginx/sites-available/whoneedhelp.imalto.site
|
|
sudo ln -s \
|
|
/etc/nginx/sites-available/whoneedhelp.imalto.site \
|
|
/etc/nginx/sites-enabled/whoneedhelp.imalto.site
|
|
sudo nginx -t
|
|
sudo systemctl reload nginx
|
|
sudo certbot --nginx --redirect -d whoneedhelp.imalto.site
|
|
sudo nginx -t
|
|
```
|
|
|
|
If validation fails before certificate issuance, remove only the new symlink
|
|
and file, validate the previous configuration, and reload:
|
|
|
|
```bash
|
|
sudo rm -f /etc/nginx/sites-enabled/whoneedhelp.imalto.site
|
|
sudo rm -f /etc/nginx/sites-available/whoneedhelp.imalto.site
|
|
sudo nginx -t
|
|
sudo systemctl reload nginx
|
|
```
|