diff options
| author | generalfuzz <generalfuzz@gmail.com> | 2022-03-17 11:15:08 -0700 |
|---|---|---|
| committer | Radosław Piliszek <radoslaw.piliszek@gmail.com> | 2022-05-30 08:11:54 +0000 |
| commit | d424a63d6049d8d241ab1294aea035d4b187a111 (patch) | |
| tree | f9970225c97849aade902d953c60135ad73942bd /docker/haproxy/haproxy-ssh/extend_start.sh | |
| parent | 9d5bdbf36d477da38b0dd7d44b3fc6feb9325378 (diff) | |
| download | kolla-d424a63d6049d8d241ab1294aea035d4b187a111.tar.gz kolla-d424a63d6049d8d241ab1294aea035d4b187a111.zip | |
Replace Certbot with Lego for Let's Encrypt container
Replaces Certbot with Lego for certificate retrieval and renewal.
Lego includes support for DNS ACME Challenges.
Adds ssh-client to LetsEncrypt and ssh-server to HAProxy to allow both
the transfer of Let's Encrypt certificates to the HAProxy container and
to enable live updating of HAProxy certifices using the HAProxy API
exposed on the local HAProxy socket.
Implements: blueprint letsencrypt-https
Change-Id: I737e1ce5bfc37d0703879c8272a9e915084c5ca6
Diffstat (limited to 'docker/haproxy/haproxy-ssh/extend_start.sh')
| -rw-r--r-- | docker/haproxy/haproxy-ssh/extend_start.sh | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/docker/haproxy/haproxy-ssh/extend_start.sh b/docker/haproxy/haproxy-ssh/extend_start.sh new file mode 100644 index 000000000..d571e7292 --- /dev/null +++ b/docker/haproxy/haproxy-ssh/extend_start.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +SSH_HOST_KEY_TYPES=( "ecdsa" ) + +for key_type in ${SSH_HOST_KEY_TYPES[@]}; do + KEY_PATH=/etc/ssh/ssh_host_${key_type}_key + if [[ ! -f "${KEY_PATH}" ]]; then + ssh-keygen -q -t ${key_type} -f ${KEY_PATH} -N "" + fi +done + +mkdir -p /var/lib/haproxy/.ssh + +if [[ $(stat -c %U:%G /var/lib/haproxy/.ssh) != "haproxy:haproxy" ]]; then + sudo chown haproxy: /var/lib/haproxy/.ssh +fi |