这是indexloc提供的服务,不要输入任何密码
Skip to content

Conversation

@blopker
Copy link
Contributor

@blopker blopker commented Dec 13, 2015

So this is kind of large, sorry. Feel free to pick it apart in to your own changes if you'd like. I won't mind 😄

The main change here is to fix the permissions of certificates. I'm not sure how it was working for people before (was it?), but the letsencrypt docker container was creating certs with root permissions and dokker couldn't use them. I added another docker run command to fix this. Otherwise I had to manually fix the permissions and rerun nginx:build-config.

Anyway, I also cleaned some other stuff up, like simplifying the command to letsencrypt <app>. I also fixed the README to include sudo when installing along with other things.

Cheers!

@sseemayer
Copy link
Contributor

Thanks for the PR! I really like all the improvements 👍

Regarding the permissions of the certificates, the previous strategy which was working on my system (Ubuntu 14.04 LTS running dokku 0.4.4) was that everything under the $DOKKU_ROOT/letsencrypt folder was owned by root:root with permissions 700, except for the live and archive folders with owner root:dokku and permissions 710 (so that the group dokku can enter the folders). live contains the symlinks (permissions ) to the active certificates/keys in archive that get assigned permissions 644 by the letsencrypt container by default. This way, both nginx and dokku were able to read the certificates and keys for me.

Could you find out for me how the ownership/permissions looked on your system before making the ownership and permissions changes on your PR? I'm still hoping for a simpler solution that doesn't need permission fixing :-)

@blopker
Copy link
Contributor Author

blopker commented Dec 14, 2015

Does dokku cert:info <app> work for you?

@sseemayer
Copy link
Contributor

Yes, both certs:info and loading the certificate/keys in nginx works for me.

@blopker
Copy link
Contributor Author

blopker commented Dec 14, 2015

OK, let me see if changing the group permissions on folders will stick. Then the second run can be removed.

@blopker
Copy link
Contributor Author

blopker commented Dec 15, 2015

Alright! This works for me. I basically just copied the install file in to commands so it will make the root folder if it gets removed. Also ran the scripts through shellshock and fixed up some issues.

No more second docker run.

sseemayer added a commit that referenced this pull request Dec 15, 2015
Fixes permissions issues
@sseemayer sseemayer merged commit 3e1f3fc into dokku:master Dec 15, 2015
@sseemayer
Copy link
Contributor

Awesome! Thanks so much for this, this has improved the plugin greatly!

@blopker
Copy link
Contributor Author

blopker commented Dec 15, 2015

Sweet. You need to get this plugin listed on http://dokku.viewdocs.io/dokku/plugins/

Probably should emphasize the 'zero-downtime' aspect.

@sseemayer
Copy link
Contributor

PR is filed: dokku/dokku#1779

@blopker
Copy link
Contributor Author

blopker commented Dec 16, 2015

Nice! It's been working too well for me, they cut me off and now I have to
wait a week to get more certs... :)

On Wed, Dec 16, 2015, 12:33 AM Stefan Seemayer notifications@github.com
wrote:

PR is filed: dokku/dokku#1779 dokku/dokku#1779


Reply to this email directly or view it on GitHub
#6 (comment)
.

@sseemayer sseemayer mentioned this pull request Apr 6, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants