Comments (7)
Hi @constantineav, looks like the error message is chunked, could you share surrounding lines as well?
Also could you share the config you passed to autossl?
from lua-resty-acme.
Hi!
stream section
stream {
init_worker_by_lua_block {
require("resty.acme.autossl").init({
staging = false,
tos_accepted = true,
enabled_challenge_handlers = { 'tls-alpn-01' },
account_key_path = "/etc/openresty/account.key",
account_email = "admin@mydomain",
domain_whitelist = setmetatable({}, { __index = function(_, k)
return ngx.re.match(k, [[^ws\.mydomain\.ru$]], "jo")
end}),
storage_adapter = "redis",
storage_config = {
host = os.getenv("REDIS_HOST"),
port = 6379,
database = 15,
auth = os.getenv("REDIS_PASS"),
},
})
require("resty.acme.autossl").init_worker()
}
map $ssl_preread_alpn_protocols $backend {
~\bacme-tls/1\b unix:/tmp/nginx-tls-alpn.sock;
default unix:/tmp/nginx-default.sock;
}
server {
listen 443;
listen [::]:443;
ssl_preread on;
proxy_pass $backend;
proxy_protocol on;
}
server {
listen unix:/tmp/nginx-tls-alpn.sock ssl proxy_protocol;
ssl_certificate /etc/openresty/default.pem;
ssl_certificate_key /etc/openresty/default.key;
set_real_ip_from unix:;
ssl_certificate_by_lua_block {
require("resty.acme.autossl").serve_tls_alpn_challenge()
}
content_by_lua_block {
ngx.exit(0)
}
}
}
http block
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
lua_ssl_verify_depth 2;
lua_shared_dict acme 64m;
resolver 8.8.8.8 ipv6=off;
init_by_lua_block {
require("resty.acme.autossl").init({
staging = false,
tos_accepted = true,
enabled_challenge_handlers = { 'tls-alpn-01' },
account_key_path = "/etc/openresty/account.key",
account_email = "admin@mydomain",
domain_whitelist = setmetatable({}, { __index = function(_, k)
return ngx.re.match(k, [[^ws\.mydomain\.ru$]], "jo")
end}),
storage_adapter = "redis",
storage_config = {
host = os.getenv("REDIS_HOST"),
port = 6379,
database = 15,
auth = os.getenv("REDIS_PASS"),
},
})
}
init_worker_by_lua_block {
require("resty.acme.autossl").init_worker()
}
There is also a proposal for http-01. It would be cool if the answer to the request from letsencrypt was put in redis(or other shared storage). So that any server can confirm the validity if the domain is registered in dns round-robin.
from lua-resty-acme.
full log.
2021/06/01 10:11:50 [error] 6#6: init_worker_by_lua error: ...al/openresty/luajit/share/lua/5.1/resty/acme/autossl.lua:344: shm acme is not defined
stack traceback:
[C]: in function 'error'
...al/openresty/luajit/share/lua/5.1/resty/acme/autossl.lua:344: in function 'init'
init_worker_by_lua:2: in main chunk
i apply patch and all work
from lua-resty-acme.
It would be cool if the answer to the request from letsencrypt was put in redis(or other shared storage). So that any server can confirm the validity if the domain is registered in dns round-robin.
You can do this. You need to pass a second argument to autossl.init that sets up storage for ACME challenges.
autossl.init({
...
storage_adapter = "redis",
storage_config = {
host = os.getenv("REDIS_HOST"),
port = tonumber(os.getenv("REDIS_PORT")),
database = 0,
auth = os.getenv("REDIS_AUTH"),
},
...
}, {
-- storage for ACME challenges
storage_adapter = "redis",
storage_config = {
host = os.getenv("REDIS_HOST"),
port = tonumber(os.getenv("REDIS_PORT")),
database = 1,
auth = os.getenv("REDIS_AUTH"),
},
})
from lua-resty-acme.
wow! Thank you!
from lua-resty-acme.
Note, there is race condition between server instances as they all attempt renewals simultaneously. It causes some warning messages (and let's encrypt complaining about buggy client). You should increase lock expiration time as in this commit kfigiela@65b3451
from lua-resty-acme.
This storage config part is a bug, it should pass stoage config automatically. I will fix in next commits.
from lua-resty-acme.
Related Issues (20)
- 按照Synopsis的步骤操作之后,没有生效,访问网站发现使用的是fallback证书,如何查找原因呢? HOT 4
- check_renew() function is run whenever the nginx workers are reloaded HOT 3
- http-01 failed HOT 4
- How do I use ZeroSSL? HOT 3
- Error while trying to use subdomain with "_" simbol HOT 2
- How to use it? HOT 3
- -
- - HOT 1
- ZeroSSL integration failing to create account HOT 5
- How to configure other storage configs when in DB-less? HOT 2
- Zerossl config api_uri but error ngx.timer HOT 5
- Storage adapter not connect redis HOT 1
- -
- BoringSSL not working HTTP3 HOT 2
- error during acme login HOT 2
- get_certkey_parsed: Pass stale certificate if getting certificate from storage fails HOT 2
- Problem with update locks HOT 4
- Option to delete none whitelisted domains in certificate update HOT 2
- Check cache from domain_whitelist_callback? HOT 7
- Ability to block the first request until certs are created? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lua-resty-acme.