Merge branch 'feat-internal-ca' into prod

.gitignore

@@ -5,3 +5,5 @@ etc_wireguard/*
 matrix/synapse_data/*
 matrix/.env
 step-ca/*
+!step-ca/config
+!step-ca/templates

compose.yml

@@ -21,14 +21,20 @@ services:
       - "80:80"
       - "443:443"
       - "51820:51820/udp"
+      # - "9000:9000"
+      # - "53:53"
     networks:
       - backend
     dns:
       - 1.1.1.1
       - 8.8.8.8
+    extra_hosts:
+      - "wg.dfnk:10.8.0.1"
+      - "ca.dfnk:10.8.0.1"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821"
+      # - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+      - "traefik.http.services.wg-easy-svc.loadbalancer.server.url=http://127.0.0.1:51821"
 
       # Configuration for public access with auth middleware
       - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
@@ -43,6 +49,7 @@ services:
       - "traefik.http.routers.wg-easy-private.entrypoints=websecure"
       # No certresolver here, will mess with browsers
       - "traefik.http.routers.wg-easy-private.tls=true"
+      - "traefik.http.routers.wg-easy-private.tls.certresolver=defenk"
       - "traefik.http.routers.wg-easy-private.service=wg-easy-svc"
 
   traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
@@ -57,9 +64,11 @@ services:
       - "./letsencrypt:/letsencrypt"
       - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
       - "./dynamic.yml:/etc/traefik/dynamic.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
+      - "./step-ca/certs/root_ca.crt:/etc/traefik/certs/root_ca.crt:ro" #Maps traefik root cert to the one being used by step-ca
     environment:
       - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr
       - LEGO_DISABLE_CNAME_SUPPORT=true
+      - LEGO_CA_CERTIFICATES=/etc/traefik/certs/root_ca.crt
   dns:
     image: dockurr/dnsmasq
     container_name: defenk-dns
@@ -69,6 +78,25 @@ services:
     network_mode: "service:wg-easy"
     depends_on:
       - wg-easy
+  step-ca:
+    image: smallstep/step-ca:latest
+    container_name: defenk-step-ca
+    restart: unless-stopped
+    # ports:
+    #   - "9000:9000"
+    volumes:
+      - ./step-ca/:/home/step
+    environment:
+      - DOCKER_STEPCA_INIT_NAME=DEFENK CA
+      - DOCKER_STEPCA_INIT_DNS_NAMES=ca.dfnk
+      - DOCKER_STEPCA_INIT_PASSWORD_FILE=/home/step/password.txt
+    depends_on: 
+      - wg-easy
+    network_mode: "service:wg-easy"
+    # networks:
+    #   backend:
+    #     - ca.dfnk
+    #     - step-ca
 
 networks:
   # Backend network for docker containers to talk to eachother

dnsmasq.conf

@@ -1,3 +1,6 @@
+# Dont red host resolv.conf
+no-resolv
+
 # forward default traffic
 server=1.1.1.1
 server=8.8.8.8
@@ -6,3 +9,4 @@ server=8.8.8.8
 address=/.dfnk/10.8.0.1
 address=/proxmox.dfnk/10.8.0.2
 address=/media.dfnk/192.168.1.35
+address=/ca.dfnk/10.8.0.1

step-ca/config/ca.json

@@ -0,0 +1,63 @@
+{
+	"root": "/home/step/certs/root_ca.crt",
+	"federatedRoots": null,
+	"crt": "/home/step/certs/intermediate_ca.crt",
+	"key": "/home/step/secrets/intermediate_ca_key",
+	"address": ":9000",
+	"insecureAddress": "",
+	"dnsNames": [
+		"ca.dfnk"
+	],
+	"logger": {
+		"format": "text"
+	},
+	"db": {
+		"type": "badgerv2",
+		"dataSource": "/home/step/db",
+		"badgerFileLoadingMode": ""
+	},
+	"authority": {
+		"provisioners": [
+			{
+				"type": "JWK",
+				"name": "admin",
+				"key": {
+					"use": "sig",
+					"kty": "EC",
+					"kid": "cP9nd7cP75Y5LAkc0Vu7VvyD2oag9WCkn8bOm7CR8_U",
+					"crv": "P-256",
+					"alg": "ES256",
+					"x": "qI9EW58PSUDnDQm7XYThkftUdWAqZxU2QqmfgE0SsXA",
+					"y": "pRQShqpmfG0jlAdAxIL93xj9pukGm0hpj4E2_9FxbKI"
+				},
+				"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiYUY5RVNXNHFwX1VENnp2cXBGakszZyJ9.S2sjdhd5yZQT0h0Yx7H269OEM1qZS-XYtS6buFBEoFAvztUfgG4UUg.Dor8ZyZJ3PVLjgGM.I2j3wSx3Rmo45WnO07EWyZncV6Bw6vTV3niEopSxEaMiRGoSFIRRd1UtIcPaMOv-6-PmuCCRBdfd6dszk9MgzJm04QtERg150F6foBcjlcdAjsHh-2pwnVUYdC_QiHt0y1ovaRHXgMbGWAuhW0TKf0TFUQPMErv5czdeofl2tkQAXLu0YKqxKzT8cdhEyGzZHozKocveEE-4CEqYNHiEJOQ676yVEkdaDDLaAp-EpkJI6DJj87CjQRgSAZmYnVsVp9eO8lNpXkyEVXL3QsHXDLxhpN0IiuFlCRp6dqySuN-MKywt3VU4Jl7evwpXz_DjEus91vF3YXqnTaRQSJc.7XePzloYTpkkpq0Ybp1KxQ"
+			},
+			{
+				"type": "ACME",
+				"name": "acme",
+				"claims": {
+					"enableSSHCA": true,
+					"disableRenewal": false,
+					"allowRenewalAfterExpiry": false,
+					"disableSmallstepExtensions": false
+				},
+				"options": {
+					"x509": {},
+					"ssh": {}
+				}
+			}
+		],
+		"template": {},
+		"backdate": "1m0s"
+	},
+	"tls": {
+		"cipherSuites": [
+			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+		],
+		"minVersion": 1.2,
+		"maxVersion": 1.3,
+		"renegotiation": false
+	},
+	"commonName": "Step Online CA"
+}

step-ca/config/defaults.json

@@ -0,0 +1,6 @@
+{
+	"ca-url": "https://ca.dfnk:9000",
+	"ca-config": "/home/step/config/ca.json",
+	"fingerprint": "7bf0757de0fb64f0c8864730135b9ba46d72e2ad5603ae488defa32de6c7515e",
+	"root": "/home/step/certs/root_ca.crt"
+}

traefik.yml

@@ -31,6 +31,8 @@ entryPoints:
       encodedCharacters:
         allowEncodedSlash: true
         allowEncodedHash: true  # This is crucial for Matrix room aliases!
+        tls:
+          certResolver: basic
 
         # Declaring the user list
 
@@ -52,3 +54,9 @@ certificatesResolvers:
         resolvers:
           - "1.1.1.1:53"
           - "8.8.8.8:53"
+  defenk:
+    acme:
+      email: "admin-defenk@riverrooks.dev"
+      caServer: "https://ca.dfnk:9000/acme/acme/directory"
+      storage: "/letsencrypt/internal_acme.json"
+      tlsChallenge: {}