Nginx Proxy Manager

[geosone]

The Nginx Proxy Manager sets the cert names to some unuasual names realated to its internal config.

root@nginxproxymanager:/etc/letsencrypt/live# ls
npm-11  npm-13  npm-15  npm-17  npm-19  npm-21  npm-23  npm-25  npm-27  npm-29  npm-33  npm-36  npm-39  npm-41  npm-45  npm-50  npm-52  npm-54  npm-6  README
npm-12  npm-14  npm-16  npm-18  npm-20  npm-22  npm-24  npm-26  npm-28  npm-32  npm-34  npm-37  npm-40  npm-43  npm-48  npm-51  npm-53  npm-55  npm-9

coudl you add an option that it would set the domainname on the reciving client. because at the moment the same name appears on the client.

Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport: [chan 0] Max packet in: 32768 bytes
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport: [chan 0] Max packet out: 32768 bytes
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport: Secsh channel 0 opened.
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport: [chan 0] Sesch channel 0 request ok
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: INFO:paramiko.transport.sftp: [chan 0] Opened sftp connection (server version 3)
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: _sftp_mkdir: path=/var/cache/certdeploy/npm-50, mode=None
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] stat(b'/var/cache/certdeploy/npm-50')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: _sftp_mkdir: path=/var/cache/certdeploy, mode=None
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] stat(b'/var/cache/certdeploy')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] mkdir(b'/var/cache/certdeploy/npm-50', None)
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: Copying /etc/letsencrypt/live/npm-50/chain.pem to /var/cache/certdeploy/npm-50/chain.pem
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] open(b'/var/cache/certdeploy/npm-50/chain.pem', 'wb')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] open(b'/var/cache/certdeploy/npm-50/chain.pem', 'wb') -> 687831
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] close(687831)
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] stat(b'/var/cache/certdeploy/npm-50/chain.pem')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: Copying /etc/letsencrypt/live/npm-50/fullchain.pem to /var/cache/certdeploy/npm-50/fullchain.pem
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] open(b'/var/cache/certdeploy/npm-50/fullchain.pem', 'wb')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] open(b'/var/cache/certdeploy/npm-50/fullchain.pem', 'wb') -> 687832
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] close(687832)
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] stat(b'/var/cache/certdeploy/npm-50/fullchain.pem')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: Copying /etc/letsencrypt/live/npm-50/privkey.pem to /var/cache/certdeploy/npm-50/privkey.pem
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] open(b'/var/cache/certdeploy/npm-50/privkey.pem', 'wb')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] open(b'/var/cache/certdeploy/npm-50/privkey.pem', 'wb') -> 687833
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] close(687833)
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport.sftp: [chan 0] stat(b'/var/cache/certdeploy/npm-50/privkey.pem')
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: INFO:paramiko.transport.sftp: [chan 0] sftp session closed.
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport: [chan 0] EOF sent (0)
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: INFO:certdeploy-server: Pushed /etc/letsencrypt/live/npm-50 to certdeploy@[x.x.x.x]]:33774 in 1 attempts
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: Done pushing /etc/letsencrypt/live/npm-50 to certdeploy@[x.x.x.x]:33774
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:paramiko.transport: [chan 0] EOF received (0)
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: INFO:certdeploy-server: Done pushing all lineages to certdeploy@[x.x.x.x]]:33774
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: Finished pushing to certdeploy@x.x.x.x]:33774
Aug 27 22:00:22 nginxproxymanager certdeploy-server[12034]: DEBUG:certdeploy-server: Queue length is 0, worker count is 0

and on the client

root@dash:~# cat /var/log/certdeploy/certdeploy*
DEBUG:certdeploy-client: New service SystemdUnit from config: config={'type': 'systemd', 'name': 'apache2.service'}
DEBUG:certdeploy-client: timeout = False, self.timeout = False
DEBUG:certdeploy-client: New service: <SystemdUnit: action=restart, filters={}, name=apache2.service, timeout=False>
DEBUG:certdeploy-client: Running daemon
DEBUG:certdeploy-client: Opening socket on port 33774 at address 
INFO:certdeploy-client: Listening for incoming connections at 0.0.0.0:33774
INFO:certdeploy-client: Got connection from ('x.x.x.x', 33620)
DEBUG:certdeploy-client: stat: path=/var/cache/certdeploy/npm-50
DEBUG:certdeploy-client: stat: path=/var/cache/certdeploy
DEBUG:certdeploy-client: mkdir: path=/var/cache/certdeploy/npm-50, attr=?---------   1 0        0               0 (unknown date) ?
DEBUG:certdeploy-client: open: path=/var/cache/certdeploy/npm-50/chain.pem, flags=577, attr=?---------   1 0        0               0 (unknown date) ?
DEBUG:certdeploy-client: open: open /var/cache/certdeploy/npm-50/chain.pem with flags=577 and mode=384 (default mode)
DEBUG:certdeploy-client: open: fdopen /var/cache/certdeploy/npm-50/chain.pem with mode=wb
DEBUG:certdeploy-client: stat: path=/var/cache/certdeploy/npm-50/chain.pem
DEBUG:certdeploy-client: open: path=/var/cache/certdeploy/npm-50/fullchain.pem, flags=577, attr=?---------   1 0        0               0 (unknown date) ?
DEBUG:certdeploy-client: open: open /var/cache/certdeploy/npm-50/fullchain.pem with flags=577 and mode=384 (default mode)
DEBUG:certdeploy-client: open: fdopen /var/cache/certdeploy/npm-50/fullchain.pem with mode=wb
DEBUG:certdeploy-client: stat: path=/var/cache/certdeploy/npm-50/fullchain.pem
DEBUG:certdeploy-client: open: path=/var/cache/certdeploy/npm-50/privkey.pem, flags=577, attr=?---------   1 0        0               0 (unknown date) ?
DEBUG:certdeploy-client: open: open /var/cache/certdeploy/npm-50/privkey.pem with flags=577 and mode=384 (default mode)
DEBUG:certdeploy-client: open: fdopen /var/cache/certdeploy/npm-50/privkey.pem with mode=wb
DEBUG:certdeploy-client: stat: path=/var/cache/certdeploy/npm-50/privkey.pem

on the other side i don't get the certs updated correctly.

root@nginxproxymanager:/etc/letsencrypt/live# cat /etc/certdeploy/server.yml 
---


privkey_filename: /etc/certdeploy/server_key
log_filename: /var/log/letsencrypt/certdeploy.log
log_level: DEBUG
sftp_log_filename: /var/log/letsencrypt/certdeploy_sftp.log
sftp_log_level: DEBUG
client_configs:
  - address: x.x.x.x
    port: 33774
    needs_chain: true
    needs_fullchain: true
    needs_privkey: true
    pubkey: ssh-ed25519 .........
    domains:
      - dash........

on the client side

root@dash:~# cat /etc/certdeploy/client.yml 
---
destination: /etc/letsencrypt/live
update_services:
  - type: systemd
    name: apache2.service
log_filename: /var/log/certdeploy/certdeploy.log
log_level: DEBUG
file_permissions:
  mode: 0o600
  directory_mode: 0o700
  owner: root
  group: root
sftpd:
  listen_port: 33774
  privkey_filename: /etc/certdeploy/client_key
  server_pubkey_filename: /etc/certdeploy/server_key.pub
  log_filename: /var/log/certdeploy/certdeploy_sftp.log
  log_level: CRITICAL

so where i have a config problem ?

by the way when i get everything working i will create an howto for install on debian with virtualenv systemd config and tempfile.d config, logrotate.d ....

[geosone]

just ssen the restart happens later

Aug 27 23:55:31 dash certdeploy-client[3178]: DEBUG:certdeploy-client: Updating <SystemdUnit: action=restart, filters={}, name=apache2.service, timeout=False>
Aug 27 23:55:31 dash certdeploy-client[3178]: ERROR:certdeploy-client: SystemdError: SystemdUnit apache2.service failed to update: TimeoutExpired: Command '['/usr/bin/systemctl', 'restart', 'apache2.service']'>
Aug 27 23:55:31 dash certdeploy-client[3178]: Traceback (most recent call last):
Aug 27 23:55:31 dash certdeploy-client[3178]:   File "/opt/certdeploy/lib/python3.11/site-packages/certdeploy/client/update.py", line 224, in update_systemd_unit
Aug 27 23:55:31 dash certdeploy-client[3178]:     proc.wait(timeout=unit.timeout)
Aug 27 23:55:31 dash certdeploy-client[3178]:   File "/usr/lib/python3.11/subprocess.py", line 1262, in wait
Aug 27 23:55:31 dash certdeploy-client[3178]:     return self._wait(timeout=timeout)
Aug 27 23:55:31 dash certdeploy-client[3178]:            ^^^^^^^^^^^^^^^^^^^^^^^^^^^
Aug 27 23:55:31 dash certdeploy-client[3178]:   File "/usr/lib/python3.11/subprocess.py", line 1989, in _wait
Aug 27 23:55:31 dash certdeploy-client[3178]:     raise TimeoutExpired(self.args, timeout)
Aug 27 23:55:31 dash certdeploy-client[3178]: subprocess.TimeoutExpired: Command '['/usr/bin/systemctl', 'restart', 'apache2.service']' timed out after False seconds
Aug 27 23:55:31 dash certdeploy-client[3178]: INFO:certdeploy-client: Updated services

[haxwithaxe]

There is a delay between when the client receives the certs and when it moves them over and updates services. By default it's 1 hour. This is to prevent restarting services over and over when updating multiple domains. How long did you wait before checking if they moved? It might just be that it hadn't happened yet.

You can change the delay in the client's config with the update_delay option. It's an interval like 1h (1 hour) or 10m (10 minutes).

I'm in the middle of rewriting the client to use a simpler transfer protocol so I'll keep the domain names in mind. It might not happen in the first iteration but it will probably happen eventually.

[geosone]

also a small find is that if the service is not running the restart is failing so a check if the service is runnign is needed because a restart ist not wrking if the serve is not up so reload restart and start_or_restart schoudl be a possble option. and in the case of the borken old software we have an oneshot service (an sql script that paste the cert key chaiin into the db2 dataabse and forces a cert relaod via an api request) so a std start woudl also make sense. yes i have seen the script optin but we have moved everyhthing to systemd and journald and via journalbeat to the log server.

[haxwithaxe]

I turned your last comment into a new ticket #4 . I have a request for a test in your environment in there.

[geosone]

oftopic: by the way i am also working on a hock that will generate the config for the server still in the early stages of finding the hook point. where i can get the ip/hostname and the other infos needed.the server pub cert will be placed under .well-known in the nginx. so the clint installscript can download it. at the moment certbot prescript that query sqlite db for the certname ip correelation. hope it will work