Skip to main content

Full How to Guide

The steps taken to get this setup are outlined below, note that I tested this on a real beta.web.tasking.rpp.cybercrucible.com beta domain and environment, the examples included are for this environment but replace with the actual values for wherever the new setup is.

  1. Create new AWS IAM user and save the credentials. Assign this user the already created policy called "acme-dns01-cybercrucible", this is a tightly scoped policy used for this purpose only. Making a new user per machine would be a good practice
  2. Make sure the domains you wants are created in AWS Route53, no record gets made for the alias used in certs such as "upstream.beta.web.tasking.rpp.cybercrucible.com"
  3. Springboot application.properties update. Get rid of all the "server.ssl.key-store..." values, the new docker setup has environment variables for SPRING_SSL_BUNDLE_PEM_ACME_KEYSTORE_CERTIFICATE and related fields
  4. SSH to the machine where the upstreams are, this would be azul for rest-web for example, and cd to the docker directory for the upstream. Make new files listed here, this is the sample layour for rest-web upstream in the docker dir: compose.yml, certbot-deploy-hook.sh, .env, aws.env, rest-web.war, start.sh, and rest-mongo-keystore.jks
  5. Edit the .env file, this is for cert variable names: 
    1. CERT_NAME=rest-web-beta
      PRIMARY_DOMAIN=river.beaver.beta.web.tasking.rpp.cybercrucible.com
      ALIAS_DOMAIN=upstream.beta.web.tasking.rpp.cybercrucible.com
      EXTRA_DOMAINS=-d green.fox.beta.web.tasking.rpp.cybercrucible.com 
          -Note that if this docker dir has multiple upstreams then list each one here  with '-d' before the domain like shown here, if only 1 upstream then this can be blank and just list the 1 under PRIMARY_DOMAIN
      ACME_EMAIL=support@cybercrucible.com
  6. Edit the aws.env file
    AWS_ACCESS_KEY_ID=AKIA...
    AWS_SECRET_ACCESS_KEY=...
    AWS_DEFAULT_REGION=us-west-2
    AWS_USE_DUALSTACK_ENDPOINT=true #if host/docker env only has IPV6 then leave this line here, if it has ipv4 you can uncomment
  7. Edit the certbot-deploy-hook.sh file, also run chmod +x on the file
    1. #!/bin/sh
      set -eu
      LIVE="/etc/letsencrypt/live/${CERT_NAME}"
      DEST=/etc/letsencrypt/deployed
      mkdir -p "$DEST"
      cp -L "$LIVE/privkey.pem"   "$DEST/.privkey.tmp"   && chmod 600 "$DEST/.privkey.tmp"
      cp -L "$LIVE/fullchain.pem" "$DEST/.fullchain.tmp" && chmod 644 "$DEST/.fullchain.tmp"
      mv -f "$DEST/.privkey.tmp"   "$DEST/privkey.pem"
      mv -f "$DEST/.fullchain.tmp" "$DEST/fullchain.pem"
      echo "$(date -u +%FT%TZ) published ${CERT_NAME} to $DEST" >> /etc/letsencrypt/deploy.log
  8. Edit compose.yml file, see the attachment section 4.5 for what to put
    1. You should only need to edit the x-restServiceTemplate: &restServiceTemplate and services sections and copy paste the other sections in without change
  9. You can test the certbot-init by adding --staging in the certbot-init command section in compose.yml and run it and make sure logs look good. Then remove the --staging and force production reissue with this command:
    1. sudo docker compose run --rm certbot-init \
        "certbot certonly --dns-route53 --cert-name <CERT_NAME> \
         -d <PRIMARY_DOMAIN> -d <ALIAS_DOMAIN> <extra -d flags> \
         --key-type ecdsa --non-interactive --agree-tos -m <ACME_EMAIL> \
         --force-renewal && CERT_NAME=<CERT_NAME> /etc/letsencrypt/renewal-hooks/deploy/publish.sh"
    2. Command I used in beta setup:
      1. sudo docker compose run --rm certbot-init sh -c   "certbot certonly --dns-route53 --cert-name rest-web-beta \
            -d river.beaver.beta.web.tasking.rpp.cybercrucible.com \
            -d upstream.beta.web.tasking.rpp.cybercrucible.com \
            -d green.fox.beta.web.tasking.rpp.cybercrucible.com \
            --key-type ecdsa --non-interactive --agree-tos -m support@cybercrucible.com \
            -force-renewal && CERT_NAME=rest-web-beta /etc/letsencrypt/renewal-hooks/deploy/publish.sh"
  10. Make sure the dockers are running
  11. Verify with these commands

    1. # Cert content, from inside the container:
      sudo docker exec <containerName> sh -c \
        "openssl x509 -in /certs/deployed/fullchain.pem -noout -issuer -ext subjectAltName"
      # Want: issuer O=Let's Encrypt (no STAGING), all SANs listed.

      # App started:
      sudo docker logs <containerName> | grep -iE "started|error"

Back to top