ac/ac-platform-edge
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-platform-edge synced 2026-07-29 04:17:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

fe: certbot renew smoke script and INSTALL TLS section

Browse Source 
Optional manual/cert rehearsal helper; existing certbot cron remains primary.
This commit is contained in:
Anton Afanasyev
2026-06-24 18:10:04 +03:00
parent 3836763f13
commit 93f4afcda9
2 changed files with 88 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
fe/INSTALL.md
View File

@@ -58,3 +58,23 @@ When artc0 BE serves `/issues/` (or you proxy prod to cluster):
| `ac-fe.fragment` | `/issues/` proxy + `/crashes/` → 301; include inside `apps.f0xx.org` server when ready |
Do **not** edit `apps.conf` in git — maintain FE snippets here; PO applies on monstro.
## TLS renew + smoke
Script: `fe/ac-certbot-renew-smoke.sh` — `certbot renew` (or `--dry-run`) then HTTPS checks for `apps.f0xx.org`, `acl0.f0xx.org`, `s.f0xx.org`.
```bash
sudo fe/ac-certbot-renew-smoke.sh --dry-run # safe rehearsal
sudo fe/ac-certbot-renew-smoke.sh # renew + reload nginx if certs changed
```
Optional cron on monstro: `0 4 * * * root /var/www/.../ac-platform-edge/fe/ac-certbot-renew-smoke.sh --quiet`
| Host | Cert path (live) |
|------|------------------|
| `apps.f0xx.org` | `/etc/letsencrypt/live/apps.f0xx.org/` |
| `acl0.f0xx.org` | `/etc/letsencrypt/live/acl0.f0xx.org/` (apex; `c1`–`c3` have separate certs today) |
| `s.f0xx.org` | `/etc/letsencrypt/live/s.f0xx.org/` — enable `include /etc/nginx/s.f0xx.org.conf;` in `nginx.conf` |
Shortener FE snippet: symlink `s.f0xx.org.conf` → `ac-ms-url-shortener/deploy/nginx.fe-s.f0xx.org.snippet`.