diff --git a/.gitignore b/.gitignore index 4e846f5..5b4d82e 100755 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,5 @@ etc_wireguard/* matrix/synapse_data/* matrix/.env step-ca/* +!step-ca/config +!step-ca/templates diff --git a/compose.yml b/compose.yml index 7313efa..7c62b11 100755 --- a/compose.yml +++ b/compose.yml @@ -21,14 +21,20 @@ services: - "80:80" - "443:443" - "51820:51820/udp" + # - "9000:9000" + # - "53:53" networks: - backend dns: - 1.1.1.1 - 8.8.8.8 + extra_hosts: + - "wg.dfnk:10.8.0.1" + - "ca.dfnk:10.8.0.1" labels: - "traefik.enable=true" - - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821" + # - "traefik.http.services.wg-easy.loadbalancer.server.port=51821" + - "traefik.http.services.wg-easy-svc.loadbalancer.server.url=http://127.0.0.1:51821" # Configuration for public access with auth middleware - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)" @@ -43,6 +49,7 @@ services: - "traefik.http.routers.wg-easy-private.entrypoints=websecure" # No certresolver here, will mess with browsers - "traefik.http.routers.wg-easy-private.tls=true" + - "traefik.http.routers.wg-easy-private.tls.certresolver=defenk" - "traefik.http.routers.wg-easy-private.service=wg-easy-svc" traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters @@ -57,9 +64,11 @@ services: - "./letsencrypt:/letsencrypt" - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings - "./dynamic.yml:/etc/traefik/dynamic.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings + - "./step-ca/certs/root_ca.crt:/etc/traefik/certs/root_ca.crt:ro" #Maps traefik root cert to the one being used by step-ca environment: - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr - LEGO_DISABLE_CNAME_SUPPORT=true + - LEGO_CA_CERTIFICATES=/etc/traefik/certs/root_ca.crt dns: image: dockurr/dnsmasq container_name: defenk-dns @@ -69,6 +78,25 @@ services: network_mode: "service:wg-easy" depends_on: - wg-easy + step-ca: + image: smallstep/step-ca:latest + container_name: defenk-step-ca + restart: unless-stopped + # ports: + # - "9000:9000" + volumes: + - ./step-ca/:/home/step + environment: + - DOCKER_STEPCA_INIT_NAME=DEFENK CA + - DOCKER_STEPCA_INIT_DNS_NAMES=ca.dfnk + - DOCKER_STEPCA_INIT_PASSWORD_FILE=/home/step/password.txt + depends_on: + - wg-easy + network_mode: "service:wg-easy" + # networks: + # backend: + # - ca.dfnk + # - step-ca networks: # Backend network for docker containers to talk to eachother diff --git a/dnsmasq.conf b/dnsmasq.conf index ce5ae00..cbd36a4 100755 --- a/dnsmasq.conf +++ b/dnsmasq.conf @@ -1,3 +1,6 @@ +# Dont red host resolv.conf +no-resolv + # forward default traffic server=1.1.1.1 server=8.8.8.8 @@ -6,3 +9,4 @@ server=8.8.8.8 address=/.dfnk/10.8.0.1 address=/proxmox.dfnk/10.8.0.2 address=/media.dfnk/192.168.1.35 +address=/ca.dfnk/10.8.0.1 diff --git a/step-ca/config/ca.json b/step-ca/config/ca.json new file mode 100644 index 0000000..0bb75f6 --- /dev/null +++ b/step-ca/config/ca.json @@ -0,0 +1,63 @@ +{ + "root": "/home/step/certs/root_ca.crt", + "federatedRoots": null, + "crt": "/home/step/certs/intermediate_ca.crt", + "key": "/home/step/secrets/intermediate_ca_key", + "address": ":9000", + "insecureAddress": "", + "dnsNames": [ + "ca.dfnk" + ], + "logger": { + "format": "text" + }, + "db": { + "type": "badgerv2", + "dataSource": "/home/step/db", + "badgerFileLoadingMode": "" + }, + "authority": { + "provisioners": [ + { + "type": "JWK", + "name": "admin", + "key": { + "use": "sig", + "kty": "EC", + "kid": "cP9nd7cP75Y5LAkc0Vu7VvyD2oag9WCkn8bOm7CR8_U", + "crv": "P-256", + "alg": "ES256", + "x": "qI9EW58PSUDnDQm7XYThkftUdWAqZxU2QqmfgE0SsXA", + "y": "pRQShqpmfG0jlAdAxIL93xj9pukGm0hpj4E2_9FxbKI" + }, + "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiYUY5RVNXNHFwX1VENnp2cXBGakszZyJ9.S2sjdhd5yZQT0h0Yx7H269OEM1qZS-XYtS6buFBEoFAvztUfgG4UUg.Dor8ZyZJ3PVLjgGM.I2j3wSx3Rmo45WnO07EWyZncV6Bw6vTV3niEopSxEaMiRGoSFIRRd1UtIcPaMOv-6-PmuCCRBdfd6dszk9MgzJm04QtERg150F6foBcjlcdAjsHh-2pwnVUYdC_QiHt0y1ovaRHXgMbGWAuhW0TKf0TFUQPMErv5czdeofl2tkQAXLu0YKqxKzT8cdhEyGzZHozKocveEE-4CEqYNHiEJOQ676yVEkdaDDLaAp-EpkJI6DJj87CjQRgSAZmYnVsVp9eO8lNpXkyEVXL3QsHXDLxhpN0IiuFlCRp6dqySuN-MKywt3VU4Jl7evwpXz_DjEus91vF3YXqnTaRQSJc.7XePzloYTpkkpq0Ybp1KxQ" + }, + { + "type": "ACME", + "name": "acme", + "claims": { + "enableSSHCA": true, + "disableRenewal": false, + "allowRenewalAfterExpiry": false, + "disableSmallstepExtensions": false + }, + "options": { + "x509": {}, + "ssh": {} + } + } + ], + "template": {}, + "backdate": "1m0s" + }, + "tls": { + "cipherSuites": [ + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" + ], + "minVersion": 1.2, + "maxVersion": 1.3, + "renegotiation": false + }, + "commonName": "Step Online CA" +} diff --git a/step-ca/config/defaults.json b/step-ca/config/defaults.json new file mode 100644 index 0000000..7becc61 --- /dev/null +++ b/step-ca/config/defaults.json @@ -0,0 +1,6 @@ +{ + "ca-url": "https://ca.dfnk:9000", + "ca-config": "/home/step/config/ca.json", + "fingerprint": "7bf0757de0fb64f0c8864730135b9ba46d72e2ad5603ae488defa32de6c7515e", + "root": "/home/step/certs/root_ca.crt" +} \ No newline at end of file diff --git a/traefik.yml b/traefik.yml index 621c2be..1f904cb 100755 --- a/traefik.yml +++ b/traefik.yml @@ -31,6 +31,8 @@ entryPoints: encodedCharacters: allowEncodedSlash: true allowEncodedHash: true # This is crucial for Matrix room aliases! + tls: + certResolver: basic # Declaring the user list @@ -52,3 +54,9 @@ certificatesResolvers: resolvers: - "1.1.1.1:53" - "8.8.8.8:53" + defenk: + acme: + email: "admin-defenk@riverrooks.dev" + caServer: "https://ca.dfnk:9000/acme/acme/directory" + storage: "/letsencrypt/internal_acme.json" + tlsChallenge: {}