soju/contrib/certbot.md

36 lines
970 B
Markdown
Raw Normal View History

2023-12-01 09:35:01 +00:00
# Setting up Certbot for soju
If you are using [Certbot] to obtain HTTPS certificates, you can set up soju
like so:
- Obtain the certificate:
certbot certonly -d <domain>
- Allow all local users to access certificates (private keys are still
protected):
chmod 0755 /etc/letsencrypt/{live,archive}
- Allow the soju user to read the private key:
chmod 0640 /etc/letsencrypt/live/<domain>/privkey.pem
chgrp soju /etc/letsencrypt/live/<domain>/privkey.pem
- Set the `tls` directive in the soju configuration file:
tls /etc/letsencrypt/live/<domain>/fullchain.pem /etc/letsencrypt/live/<domain>/privkey.pem
- Configure Certbot to reload soju. Edit
`/etc/letsencrypt/renewal-hooks/post/soju.sh` and add a command to reload
soju, for instance:
#!/bin/sh
systemctl reload soju
Then mark the script as executable:
sudo chmod 755 /etc/letsencrypt/renewal-hooks/post/soju.sh
[Certbot]: https://certbot.eff.org/