הגדר Let’s Encrypt עם דומיינים מרובים / הפניות

[textkit]

Hi @pfaffman, the edit to the original post has an erroneous + in the to: line, breaking the regex. It should be removed.

Separately, the following paragraph needs to be edited as it no longer makes sense:

There are two patterns that need to be replaced, one ending in --keylength , and another ending in --fullchainpath (in the actual file, your original domain is before each of these switches). Enter your (sub)domain (and any additional subdomains preceded by -d ) and then add the following to your app.yml hooks section (towards the end of the file):

I suggest:

Use domain1 and domain2 in this post to generate the code that you will need. domain1 is your original domain and domain2 is the additional domain that you want to add. Add the resulting after_ssl: block to the hooks: section of your app.yml and do a launcher rebuild app.

[pfaffman (Jay Pfaffman)]

Oops. I removed the + and tweaked the text. I’ll look again later when I’m at a computer

Hey @textkit, this is a wiki, so you can make further edits if you like.

[OrkoGrayskull]

Since the last update to 3.5.0.beta8-dev

/etc/runit/1.d/letsencrypt

is missing in the docker container. So it will not build. Workaround: https://www.forcewww.com/

So this stopped working:

## Add Let's Encrypt cert for non-www and www domain name
  after_ssl:
    - replace:
        filename: "/etc/runit/1.d/letsencrypt"
        from: /--keylength/
        to: "-d example.de -d www.example.de --keylength"

Before removing such tools/binaries from the Docker container, it would be nice to receive a notification…

[pacharanero (Marcus Baw)]

האם זה שינוי באופן שבו Discourse מטפל ב-LetsEncrypt או שינוי ב-LetsEncrypt עצמו?

יש לי שרת שכרגע מושפע מהבעיה הזו. לעת עתה, הפתרון העוקף שלי הוא להעיר את החלק הזה של app.yml, אבל אני מרגיש שאנחנו צריכים דרך להוסיף את האישורים הנוספים האלה להגדרה בעתיד.

[pfaffman (Jay Pfaffman)]

Discourse העביר את זה לקובץ אחר. כרגע עובדים על זה. אנסה לבדוק בימים הקרובים מה נדרש כדי לאפשר תמיכה במספר תתי-דומיינים.

[pfaffman (Jay Pfaffman)]

ערכתי את ה-OP עם תבנית חדשה, אך עדיין לא בדקתי אותה.

[nathank (Nathan Kershaw)]

@pfaffman

(If it does, please let @pfaffman know and/or just edit the above and replace with this once you see that it works).

Nope, this doesn’t work:

FAILED

Errno::ENOENT: No such file or directory @ rb_sysopen - /usr/local/bin/letsencrypt
Location of failure: /usr/local/lib/ruby/gems/3.3.0/gems/pups-1.3.0/lib/pups/replace_command.rb:11:in `read’
replace failed with the params {“filename”=>“/usr/local/bin/letsencrypt”, “from”=>“/-d spokes.nz/”, “to”=>“-d spokes.nz -d www.spokes.nz”}
bootstrap failed with exit code 1
** FAILED TO BOOTSTRAP ** please scroll up and look for earlier error messages, there may be more than one.

[pfaffman (Jay Pfaffman)]

כנראה מוקדם מדי.

אולי נסה לשים את ההחלפה בבית התחתון היכן שהיה פעם ה-ssh, אם זה הגיוני (אני בטלפון, אנסה להסתכל מחר)

[Paul_King]

Hi @nathank

Guessing here but I wonder if the error you are getting might relate to a missing space before the final slash and the final quote in the respective lines of the suggested stanza in your app.yml file?

I am inferring from the error message that your respective lines are (verbatim)

from: /-d spokes.nz/
to: “-d spokes.nz -d www.spokes.nz”

I say this, because in my case the lines are

from: /-d nzarchitecture.net.nz /
to: "-d nzarchitecture.net.nz -d www.nzarchitecture.net.nz "

And with spaces just before the end of each line as shown, I can now rebuild Discourse without throwing that error. (if you look closely you will see @pfaffman‘s updated stanza posted at start of this thread did show those extra spaces).

I have no files at all in the usr/local/bin/ directory (as noted in your error message) either, which made me suspect that lack of that letsencrypt file is not what triggers the error.

That said, for me while Discourse works ok on its url nzarchitecture.net.nz, unfortunately I still get a certificate error if typing www.nzarchitecture.net.nz into a browser - whether this is due to lack of that file, I do not know

[featheredtoast (Jeff Wong)]

רק מציין שאני מנסה כרגע לגלגל את זה למשתני סביבה כדי לטפל בהם ישירות ב-discourse_docker, משהו כמו רשימה מופרדת בפסיקים של כינויי מארח. נראה כמו מקרה שימוש נפוץ מספיק כדי לטפל בו ישירות.

זה יקל על התצורה למקרה זה, כך שאף אחד לא יצטרך לבצע שינויים ב-app.ymls שלהם.

התוכנית הנוכחית שלי היא עם DISCOURSE_HOSTNAMEwww.domain.com

אפשר סביבה כמו:
DISCOURSE_HOSTNAME_ALIASES: domain.com,other.domain.com ימשוך את התעודה, תקפה לכל שמות המארח.

(בזמן שאני שם, גם חידושי Let’s Encrypt אוטומטיים לא נראים עובדים כראוי, אז אני מתקן גם את אלה)

[pfaffman (Jay Pfaffman)]

זה מדהים! תודה רבה. זה בהחלט יקל על הדברים!

[nathank (Nathan Kershaw)]

I missed that! Did as you suggest, but still bootstrap failure:

FAILED

Errno::ENOENT: No such file or directory @ rb_sysopen - /usr/local/bin/letsencrypt
Location of failure: /usr/local/lib/ruby/gems/3.3.0/gems/pups-1.3.0/lib/pups/replace_command.rb:11:in `read’
replace failed with the params {“filename”=>“/usr/local/bin/letsencrypt”, “from”=>“/-d spokes.nz /”, “to”=>"-d spokes.nz -d www.spokes.nz "}
bootstrap failed with exit code 1
** FAILED TO BOOTSTRAP ** please scroll up and look for earlier error messages, there may be more than one.

@featheredtoast

Just noting I’m currently attempting on rolling this into env vars to handle directly in discourse_docker, something like a comma separated list of hostname aliases. Seems like a common enough use case to handle directly.

Wonderful!!!

[Paul_King]

@nathank

I missed that! Did as you suggest, but still bootstrap failure:

FAILED

Errno::ENOENT: No such file or directory @ rb_sysopen - /usr/local/bin/letsencrypt
Location of failure: /usr/local/lib/ruby/gems/3.3.0/gems/pups-1.3.0/lib/pups/replace_command.rb:11:in `read’
replace failed with the params {“filename”=>“/usr/local/bin/letsencrypt”, “from”=>“/-d spokes.nz /”, “to”=>"-d spokes.nz -d www.spokes.nz "}
bootstrap failed with exit code 1
** FAILED TO BOOTSTRAP ** please scroll up and look for earlier error messages, there may be more than one.

Probably not the central issue here, but in my thrashing about, I also updated the Docker version running on Digital Ocean from 20.0.4 (I think) to 28.3.3 - possibly that helped, at least with this error. If nothing else it did get rid of the docker ‘depreciated’ warnings I was getting at the beginning of the rebuild process.

[pfaffman (Jay Pfaffman)]

עליך להסיר את החלק שמנסה לשנות את קובץ ה-lets encrypt ולהמתין לקבלת ה-pr.

[nathank (Nathan Kershaw)]

I figured that! Fortunately, I’m on a two container install so that is no big deal.

@featheredtoast

My current plan is with DISCOURSE_HOSTNAME: www.domain.com

Allow for env like:
DISCOURSE_HOSTNAME_ALIASES: domain.com,other.domain.com would pull the cert, valid for all hostnames.

(While I’m there, let’s encrypt auto renewals also don’t seem to be working properly so I’m fixing those up too)

Any joy with this thusfar?

[featheredtoast (Jeff Wong)]

yep, I’ve got a PR open here pending review:

letsencrypt updates: renew location for .well-known, add support for multiple hostnames

[featheredtoast (Jeff Wong)]

היי לכולם, רק עדכון, דומיינים מרובים אוחדו - בגרסה האחרונה של discourse_docker, ניתן כעת לכלול את התבניות ssl ו-letsencrypt ולהגדיר משתני סביבה מהצורה DISCOURSE_HOSTNAME_ALIASES: domain.com,other.domain.com כדי להגדיר שמות מארח חלופיים.

האתר שלכם ימשוך בנוסף את שמות המארח המוגדרים עם בקשת האישור ללא שינויי תצורה נוספים.

[Paul_King]

@featheredtoast

you can now include the ssl and letsencrypt templates and setup env vars of the form DISCOURSE_HOSTNAME_ALIASES: domain.com,other.domain.com to set up alternate hostnames.

Forgive my ignorance, but is this editable via a site setting anywhere, or does something need to be edited in app.yml?

If the former, I had no luck finding it after updating to the latest, and if the latter, what specifically should be tweaked in app.yml ?

[pfaffman (Jay Pfaffman)]

@Paul_King

Forgive my ignorance, but is this editable via a site setting anywhere, or does something need to be edited in app.yml?

It goes in the app.yml. It’s not handled by Discourse, but by NGINX in the container and it doesn’t have access to the Discourse database.

@Paul_King

If the former, I had no luck finding it after updating to the latest, and if the latter, what specifically should be tweaked in app.yml

It goes in the ENV section

env:
   DISCOURSE_HOSTNAME_ALIASES: domain.com,other.domain.com

You’d include only additional domains that you would like for people to be able to link to and be redirected to your site’s actual host name.

[Paul_King]

@pfaffman

DISCOURSE_HOSTNAME_ALIASES: domain.com,other.domain.com

Perfect - all working, thanks!

Would be even better if there was some clever way for discourse to write the aliases supplied by admin to app.yml itself when next updating, or to leave the info where an app.yml instruction can read it.