JensWH/netz39-infra-ansible
1
0
Fork 0
forked from Netz39_Admin/netz39-infra-ansible
Code Pull requests Activity

Add section in README to explain HTTPS ingress setup

Browse source
This commit is contained in:
Stefan Haun 2022-08-27 16:12:21 +02:00
parent 734fbd1d75
commit c455245c6f
1 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
README.md
View file

@ -17,3 +17,17 @@ ansible-playbook -i inventory.yml --ask-vault-pass main.yml
``` ```
You need to provide a user with sudo rights and the vault password. You need to provide a user with sudo rights and the vault password.
## HTTPS ingress configuration
HTTPS ingress is controlled by the server [holmium](https://wiki.netz39.de/admin:servers:holmium) and forwarded to the configured servers.
To set up a new HTTPS vhost, the following steps need to be taken:
1. Select a domain (for internal services we use sub-domains of `.n39.eu`).
2. Create an external CNAME from this domain to `dyndns.n39.eu`.
3. Create an internal DNS entry in the [Descartes DNS config](https://gitea.n39.eu/Netz39_Admin/config.descartes/src/branch/prepare/dns_dhcp.txt). This is usually an alias on an existing server.
4. Add the entry to the [holmium playbook](holmium.yml).
5. Set up Dehydrated and vhost on the target host, e.g. using `setup-http-site-proxy`.
Do not forget to execute all playbooks with relevant changes.