feat(relay): Phase1 waves A2-E — server entry, shared-store data plane, agent runtime, deploy artifacts
RELAY-PHASE1 Wave A2/B/C/D/E (12-agent workflow, all tsc-clean, 314/314 tests pass): - A2: control-plane server.ts entry + boot/redis.ts revocation-bus wiring + start script. - B1: relay-run shared-store EnforceDeps (relay-auth ports over the SAME Postgres+Redis as P3). - B2: registry-backed MtlsVerifier (verifyAgentCert, fail-closed, INV14). - B3: store-backed RouteResolver (subdomain->hostId). - B4: Redis relay:revocations subscriber -> tunnel teardown (INV12). - B5: main-phase1.ts production entry (public bind, real TLS, async-mTLS prefetch bridge) + staging /auth/mint. - B6 (PARTIAL): relay-web operator login + browser DPoP; proof offered via term.dpop.<b64u> subprotocol. - C: agent dist/cli.js build (esbuild) + runTunnel run-loop + CliDeps. - D1: same-origin static serve of relay-web/public from the browser WSS. - E: systemd units + gen-ca/gen-capability-key/issue-tls-cert scripts + deploy/RUNBOOK.md. Adversarial review: all hard invariants PASS. Follow-ups (B7): close DPoP-subprotocol read on browser-server (blocks browser connect); rate-limit /auth/mint (F1); wire activeSessionCount (F2); scrub error logs (F5). Excludes unrelated public/style.css (concurrent iOS job).
This commit is contained in:
Yaojia Wang
145
deploy/scripts/gen-agent-ca.sh
Executable file
145
deploy/scripts/gen-agent-ca.sh
Executable file
@@ -0,0 +1,145 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# RELAY-PHASE1 · E (TASK E) — Private ENROLLMENT CA for agent mTLS.
|
||||
#
|
||||
# STAGING TEMPLATE. This mints the PRIVATE trust chain the rendezvous-relay uses to (a) verify agent
|
||||
# client certs (SPIFFE mTLS, INV14) and (b) present the relay's agent-facing SERVER cert on
|
||||
# AGENT_BIND_PORT so the dialing agent can authenticate the relay.
|
||||
#
|
||||
# *** THIS IS NOT LET'S ENCRYPT. *** The browser-facing :443 cert is public-web PKI and is issued
|
||||
# by deploy/scripts/issue-tls-cert.sh. This CA is a SEPARATE, private trust root that must NEVER be
|
||||
# a public CA — mixing them would let any web-PKI leaf enroll as an agent.
|
||||
#
|
||||
# Hierarchy produced (Ed25519, to match the control-plane dev signer's algorithm):
|
||||
# root (self-signed, offline anchor)
|
||||
# └── intermediate (signs agent SPIFFE leaves at CP /enroll, AND the relay agent-server cert)
|
||||
# ├── relay agent-server leaf (TLS serverAuth, CN/SAN = the agent-facing host)
|
||||
# └── (agent leaves are issued at runtime by the control-plane, not here)
|
||||
#
|
||||
# Outputs (0600 keys, 0644 certs) under CA_DIR (default /etc/relay/ca):
|
||||
# root.key.pem root.cert.pem
|
||||
# intermediate.key.pem intermediate.cert.pem <- CA_INTERMEDIATE_CERT_PATH (+ its key = the CP signer)
|
||||
# agent-ca.bundle.pem = intermediate + root <- AGENT_CA_CHAIN_PATH / NODE_MTLS_TRUST_BUNDLE_PATH
|
||||
# agent-ca.cert.pem = intermediate cert <- AGENT_CA_CERT_PATH
|
||||
# relay-agent-server.key.pem relay-agent-server.cert.pem (present on AGENT_BIND_PORT)
|
||||
#
|
||||
# Config via ENV only (no hardcoded hosts/ports/secrets):
|
||||
# CA_DIR output dir (default /etc/relay/ca)
|
||||
# AGENT_FACING_HOST REQUIRED — CN/SAN for the relay agent-server cert; the host the agent dials,
|
||||
# e.g. "<sub>.<BASE_DOMAIN>" (must match RELAY_URL's host in the agent config).
|
||||
# AGENT_FACING_IP OPTIONAL — extra IP SAN (e.g. 8.138.1.192) if the agent dials the raw IP.
|
||||
# RELAY_TRUST_DOMAIN OPTIONAL — SPIFFE trust domain (recorded in a NOTE only; agent SPIFFE leaves
|
||||
# are minted by the control-plane /enroll, not by this script).
|
||||
# CA_DAYS_ROOT / CA_DAYS_INT / CA_DAYS_LEAF cert lifetimes (defaults 3650 / 1825 / 825).
|
||||
#
|
||||
# Verify (syntax): bash -n deploy/scripts/gen-agent-ca.sh
|
||||
set -euo pipefail
|
||||
|
||||
CA_DIR="${CA_DIR:-/etc/relay/ca}"
|
||||
CA_DAYS_ROOT="${CA_DAYS_ROOT:-3650}"
|
||||
CA_DAYS_INT="${CA_DAYS_INT:-1825}"
|
||||
CA_DAYS_LEAF="${CA_DAYS_LEAF:-825}"
|
||||
|
||||
if [[ -z "${AGENT_FACING_HOST:-}" ]]; then
|
||||
echo "FATAL: AGENT_FACING_HOST is required (CN/SAN of the relay agent-server cert)." >&2
|
||||
echo " e.g. AGENT_FACING_HOST=term1.example.com bash $0" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
command -v openssl >/dev/null 2>&1 || { echo "FATAL: openssl not found on PATH." >&2; exit 3; }
|
||||
|
||||
umask 077
|
||||
mkdir -p "${CA_DIR}"
|
||||
cd "${CA_DIR}"
|
||||
|
||||
echo "== Enrollment CA (PRIVATE — not Let's Encrypt) into ${CA_DIR} =="
|
||||
|
||||
# ---- 1. Root CA (offline anchor) ------------------------------------------------------------------
|
||||
if [[ ! -f root.key.pem ]]; then
|
||||
openssl genpkey -algorithm ed25519 -out root.key.pem
|
||||
fi
|
||||
openssl req -x509 -new -key root.key.pem -days "${CA_DAYS_ROOT}" \
|
||||
-subj "/O=web-terminal-relay/OU=agent-enrollment/CN=web-terminal Agent Enrollment Root" \
|
||||
-addext "basicConstraints=critical,CA:TRUE" \
|
||||
-addext "keyUsage=critical,keyCertSign,cRLSign" \
|
||||
-addext "subjectKeyIdentifier=hash" \
|
||||
-out root.cert.pem
|
||||
|
||||
# ---- 2. Intermediate CA (the control-plane's leaf-signing key in staging) --------------------------
|
||||
# The CP dev in-process signer (CA_INTERMEDIATE_KMS_KEY_REF=dev-local) signs agent SPIFFE leaves with
|
||||
# THIS intermediate key. In Phase 2 the intermediate key moves into a non-exportable KMS/HSM (§3.1).
|
||||
if [[ ! -f intermediate.key.pem ]]; then
|
||||
openssl genpkey -algorithm ed25519 -out intermediate.key.pem
|
||||
fi
|
||||
openssl req -new -key intermediate.key.pem \
|
||||
-subj "/O=web-terminal-relay/OU=agent-enrollment/CN=web-terminal Agent Enrollment Intermediate" \
|
||||
-out intermediate.csr.pem
|
||||
cat > intermediate.ext <<'EXT'
|
||||
basicConstraints = critical,CA:TRUE,pathlen:0
|
||||
keyUsage = critical,keyCertSign,cRLSign
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always
|
||||
EXT
|
||||
openssl x509 -req -in intermediate.csr.pem \
|
||||
-CA root.cert.pem -CAkey root.key.pem -CAcreateserial \
|
||||
-days "${CA_DAYS_INT}" -extfile intermediate.ext \
|
||||
-out intermediate.cert.pem
|
||||
|
||||
# ---- 3. Trust bundle (intermediate + root) --------------------------------------------------------
|
||||
# The relay walks leaf -> intermediate -> root, so the anchor (root) MUST be in the bundle
|
||||
# (relay-auth verifyChain terminates at a self-signed root present in the set, INV14).
|
||||
cat intermediate.cert.pem root.cert.pem > agent-ca.bundle.pem
|
||||
cp intermediate.cert.pem agent-ca.cert.pem
|
||||
|
||||
# ---- 4. Relay agent-facing SERVER cert (presented on AGENT_BIND_PORT) -----------------------------
|
||||
# The agent dials wss://<AGENT_FACING_HOST>:<AGENT_BIND_PORT> and pins THIS CA to authenticate the
|
||||
# relay server. CN/SAN must equal the host the agent dials.
|
||||
if [[ ! -f relay-agent-server.key.pem ]]; then
|
||||
openssl genpkey -algorithm ed25519 -out relay-agent-server.key.pem
|
||||
fi
|
||||
openssl req -new -key relay-agent-server.key.pem \
|
||||
-subj "/O=web-terminal-relay/OU=agent-data-plane/CN=${AGENT_FACING_HOST}" \
|
||||
-out relay-agent-server.csr.pem
|
||||
{
|
||||
echo "basicConstraints = critical,CA:FALSE"
|
||||
echo "keyUsage = critical,digitalSignature"
|
||||
echo "extendedKeyUsage = serverAuth"
|
||||
echo "subjectKeyIdentifier = hash"
|
||||
echo "authorityKeyIdentifier = keyid,issuer"
|
||||
if [[ -n "${AGENT_FACING_IP:-}" ]]; then
|
||||
echo "subjectAltName = DNS:${AGENT_FACING_HOST},IP:${AGENT_FACING_IP}"
|
||||
else
|
||||
echo "subjectAltName = DNS:${AGENT_FACING_HOST}"
|
||||
fi
|
||||
} > relay-agent-server.ext
|
||||
openssl x509 -req -in relay-agent-server.csr.pem \
|
||||
-CA intermediate.cert.pem -CAkey intermediate.key.pem -CAcreateserial \
|
||||
-days "${CA_DAYS_LEAF}" -extfile relay-agent-server.ext \
|
||||
-out relay-agent-server.cert.pem
|
||||
|
||||
# ---- 5. Permissions + summary ---------------------------------------------------------------------
|
||||
chmod 600 ./*.key.pem
|
||||
chmod 644 ./*.cert.pem ./*.bundle.pem
|
||||
rm -f ./*.csr.pem ./*.ext
|
||||
|
||||
cat <<SUMMARY
|
||||
|
||||
Enrollment CA ready in ${CA_DIR}. Wire these env paths (relay.env / control-plane.env):
|
||||
|
||||
CA_INTERMEDIATE_CERT_PATH = ${CA_DIR}/intermediate.cert.pem
|
||||
NODE_MTLS_TRUST_BUNDLE_PATH = ${CA_DIR}/agent-ca.bundle.pem
|
||||
AGENT_CA_CERT_PATH = ${CA_DIR}/agent-ca.cert.pem
|
||||
AGENT_CA_CHAIN_PATH = ${CA_DIR}/agent-ca.bundle.pem
|
||||
|
||||
relay agent-server cert = ${CA_DIR}/relay-agent-server.cert.pem
|
||||
relay agent-server key = ${CA_DIR}/relay-agent-server.key.pem (0600)
|
||||
intermediate signing key = ${CA_DIR}/intermediate.key.pem (0600 — the CP dev signer)
|
||||
|
||||
NOTE (staging integration seam, owned by the A-wave CP boot/ca-wiring, NOT by this script):
|
||||
The control-plane's dev in-process signer must sign agent leaves with intermediate.key.pem so the
|
||||
leaves chain to this bundle. CA_INTERMEDIATE_KMS_KEY_REF=dev-local selects the dev signer; point it
|
||||
at ${CA_DIR}/intermediate.key.pem. Phase 2 replaces this with a KMS/HSM ref (§3.1).
|
||||
SPIFFE trust domain for agent leaves = ${RELAY_TRUST_DOMAIN:-<RELAY_TRUST_DOMAIN unset>}.
|
||||
|
||||
*** root.key.pem is the offline trust anchor — after first use, move it OFF this host. ***
|
||||
SUMMARY
|
||||
67
deploy/scripts/gen-capability-key.sh
Executable file
67
deploy/scripts/gen-capability-key.sh
Executable file
@@ -0,0 +1,67 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# RELAY-PHASE1 · E (TASK E) — P5 capability-token keypair (Ed25519).
|
||||
#
|
||||
# STAGING TEMPLATE. One Ed25519 keypair underpins the whole authz split:
|
||||
#
|
||||
# CONTROL-PLANE SIGNS ──(mints capability tokens with the PRIVATE key, B6 token-mint)──▶
|
||||
# RELAY VERIFIES
|
||||
# The CP admin API (POST /accounts, /pairing-codes) ALSO verifies operator "manage" tokens with
|
||||
# the SAME public key. So the public key is deployed to BOTH processes; the private key lives ONLY
|
||||
# where tokens are minted (the B6 mint), never on the relay, never committed.
|
||||
#
|
||||
# The public key is printed in TWO encodings of the SAME raw 32 bytes (the split is encoding-only):
|
||||
# CAPABILITY_SIGN_PUBKEY_B64 raw 32B, standard base64 -> control-plane env (env.ts base64ToBytes)
|
||||
# RELAY_AUTH_VERIFY_PUBKEY raw 32B, base64url (no pad) -> relay env (loadVerifyKeyFromEnv)
|
||||
# These MUST be the SAME key (PLAN §3 linchpin). This script prints both from one keypair so they
|
||||
# cannot drift.
|
||||
#
|
||||
# The PRIVATE key is written PKCS#8 PEM to a 0600 file for the B6 mint to import (WebCrypto Ed25519).
|
||||
# It is NEVER printed and NEVER placed in relay.env / control-plane.env.
|
||||
#
|
||||
# Config via ENV only:
|
||||
# KEY_DIR output dir for the private key (default /etc/relay/capability)
|
||||
#
|
||||
# Verify (syntax): bash -n deploy/scripts/gen-capability-key.sh
|
||||
set -euo pipefail
|
||||
|
||||
KEY_DIR="${KEY_DIR:-/etc/relay/capability}"
|
||||
PRIV="${KEY_DIR}/capability-sign.key.pem"
|
||||
|
||||
command -v openssl >/dev/null 2>&1 || { echo "FATAL: openssl not found on PATH." >&2; exit 3; }
|
||||
|
||||
umask 077
|
||||
mkdir -p "${KEY_DIR}"
|
||||
|
||||
if [[ -f "${PRIV}" ]]; then
|
||||
echo "WARN: ${PRIV} already exists — reusing it (delete it to rotate). Rotating INVALIDATES every" >&2
|
||||
echo " minted token AND requires re-deploying the public key to BOTH processes." >&2
|
||||
else
|
||||
openssl genpkey -algorithm ed25519 -out "${PRIV}"
|
||||
fi
|
||||
chmod 600 "${PRIV}"
|
||||
|
||||
# Raw 32-byte Ed25519 public key = last 32 bytes of the SPKI DER.
|
||||
PUB_STD_B64="$(openssl pkey -in "${PRIV}" -pubout -outform DER | tail -c 32 | openssl base64 -A)"
|
||||
# base64url of the SAME bytes, padding stripped (decodeBase64UrlBytes tolerates missing padding).
|
||||
PUB_B64URL="$(printf '%s' "${PUB_STD_B64}" | tr '+/' '-_' | tr -d '=')"
|
||||
|
||||
cat <<SUMMARY
|
||||
|
||||
P5 capability keypair ready.
|
||||
|
||||
PRIVATE key (B6 token-mint only; 0600; NEVER commit / NEVER on the relay):
|
||||
${PRIV}
|
||||
|
||||
Put the SAME public key in BOTH env files (they are one key, two encodings):
|
||||
|
||||
# control-plane.env
|
||||
CAPABILITY_SIGN_PUBKEY_B64=${PUB_STD_B64}
|
||||
|
||||
# relay.env
|
||||
RELAY_AUTH_VERIFY_PUBKEY=${PUB_B64URL}
|
||||
|
||||
Sanity check they decode to the same 32 bytes:
|
||||
diff <(openssl pkey -in "${PRIV}" -pubout -outform DER | tail -c 32 | xxd -p) \\
|
||||
<(printf '%s' "${PUB_STD_B64}" | openssl base64 -d -A | xxd -p) && echo OK
|
||||
SUMMARY
|
||||
115
deploy/scripts/issue-tls-cert.sh
Executable file
115
deploy/scripts/issue-tls-cert.sh
Executable file
@@ -0,0 +1,115 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# RELAY-PHASE1 · E (TASK E) — PUBLIC-web TLS cert for the browser :443 endpoint (Let's Encrypt).
|
||||
#
|
||||
# STAGING TEMPLATE. This is the ONLY public-CA cert in the deployment: the browser hits
|
||||
# https://<SUBDOMAIN>.<BASE_DOMAIN> (WSS same-origin), so it must chain to a public root. It is a
|
||||
# DIFFERENT trust chain from the private agent-enrollment CA (deploy/scripts/gen-agent-ca.sh) — do
|
||||
# NOT cross-wire them.
|
||||
#
|
||||
# ICP-備案 ASSUMPTION (mainland Alibaba Cloud): BASE_DOMAIN is ALREADY ICP-filed and its A-record
|
||||
# <SUBDOMAIN>.<BASE_DOMAIN> -> 8.138.1.192 resolves. Serving :80/:443 on an unfiled domain in
|
||||
# mainland CN is blocked upstream; HTTP-01 will then fail. If unfiled, use DNS-01 (no inbound :80).
|
||||
#
|
||||
# Two challenge methods (pick with ACME_METHOD):
|
||||
# http-01 — a one-shot listener on :80 answers the challenge. REQUIRES inbound :80 open in the
|
||||
# Aliyun security group DURING issuance (you can close it again after; renewals reopen).
|
||||
# dns-01 — a TXT record under _acme-challenge.<SUBDOMAIN>.<BASE_DOMAIN>. No inbound :80. Needs the
|
||||
# acme.sh DNS-API creds for your provider (e.g. Ali_Key/Ali_Secret for the Aliyun DNS API).
|
||||
#
|
||||
# Installs to TLS_CERT_PATH (fullchain) + TLS_KEY_PATH, matching relay.env.
|
||||
#
|
||||
# Config via ENV only:
|
||||
# BASE_DOMAIN REQUIRED (e.g. term.example.com)
|
||||
# SUBDOMAIN REQUIRED (the tenant sub; FQDN = <SUBDOMAIN>.<BASE_DOMAIN>)
|
||||
# ACME_EMAIL REQUIRED account/registration email
|
||||
# ACME_METHOD http-01 | dns-01 (default http-01)
|
||||
# ACME_CLIENT acme.sh | certbot (default acme.sh)
|
||||
# ACME_DNS_PROVIDER acme.sh dnsapi id for dns-01 (e.g. dns_ali) (dns-01 only)
|
||||
# TLS_CERT_PATH install target for fullchain (default /etc/relay/tls/fullchain.pem)
|
||||
# TLS_KEY_PATH install target for privkey (default /etc/relay/tls/privkey.pem)
|
||||
# ACME_STAGING 1 to use the LE staging CA (untrusted, avoids rate limits while testing)
|
||||
#
|
||||
# Verify (syntax): bash -n deploy/scripts/issue-tls-cert.sh
|
||||
set -euo pipefail
|
||||
|
||||
: "${BASE_DOMAIN:?FATAL: BASE_DOMAIN is required (your ICP-filed domain)}"
|
||||
: "${SUBDOMAIN:?FATAL: SUBDOMAIN is required}"
|
||||
: "${ACME_EMAIL:?FATAL: ACME_EMAIL is required}"
|
||||
ACME_METHOD="${ACME_METHOD:-http-01}"
|
||||
ACME_CLIENT="${ACME_CLIENT:-acme.sh}"
|
||||
TLS_CERT_PATH="${TLS_CERT_PATH:-/etc/relay/tls/fullchain.pem}"
|
||||
TLS_KEY_PATH="${TLS_KEY_PATH:-/etc/relay/tls/privkey.pem}"
|
||||
|
||||
FQDN="${SUBDOMAIN}.${BASE_DOMAIN}"
|
||||
echo "== Issuing Let's Encrypt cert for ${FQDN} via ${ACME_CLIENT} (${ACME_METHOD}) =="
|
||||
|
||||
mkdir -p "$(dirname "${TLS_CERT_PATH}")" "$(dirname "${TLS_KEY_PATH}")"
|
||||
|
||||
case "${ACME_CLIENT}" in
|
||||
acme.sh)
|
||||
command -v acme.sh >/dev/null 2>&1 || { echo "FATAL: acme.sh not installed. curl https://get.acme.sh | sh" >&2; exit 3; }
|
||||
acme.sh --register-account -m "${ACME_EMAIL}" >/dev/null 2>&1 || true
|
||||
STAGING_FLAG=""
|
||||
[[ "${ACME_STAGING:-0}" == "1" ]] && STAGING_FLAG="--staging"
|
||||
|
||||
case "${ACME_METHOD}" in
|
||||
http-01)
|
||||
echo ">> Ensure inbound :80 is OPEN in the Aliyun security group for the duration of issuance."
|
||||
acme.sh --issue ${STAGING_FLAG} -d "${FQDN}" --standalone --httpport 80
|
||||
;;
|
||||
dns-01)
|
||||
: "${ACME_DNS_PROVIDER:?FATAL: ACME_DNS_PROVIDER required for dns-01 (e.g. dns_ali); export the DNS-API creds too}"
|
||||
acme.sh --issue ${STAGING_FLAG} -d "${FQDN}" --dns "${ACME_DNS_PROVIDER}"
|
||||
;;
|
||||
*)
|
||||
echo "FATAL: ACME_METHOD must be http-01 or dns-01" >&2; exit 2 ;;
|
||||
esac
|
||||
|
||||
# --install-cert copies the current material AND registers the renew-reload hook.
|
||||
acme.sh --install-cert -d "${FQDN}" \
|
||||
--key-file "${TLS_KEY_PATH}" \
|
||||
--fullchain-file "${TLS_CERT_PATH}" \
|
||||
--reloadcmd "systemctl try-reload-or-restart relay-data-plane.service"
|
||||
;;
|
||||
|
||||
certbot)
|
||||
command -v certbot >/dev/null 2>&1 || { echo "FATAL: certbot not installed (apt-get install certbot)." >&2; exit 3; }
|
||||
STAGING_FLAG=""
|
||||
[[ "${ACME_STAGING:-0}" == "1" ]] && STAGING_FLAG="--staging"
|
||||
case "${ACME_METHOD}" in
|
||||
http-01)
|
||||
echo ">> Ensure inbound :80 is OPEN in the Aliyun security group for the duration of issuance."
|
||||
certbot certonly ${STAGING_FLAG} --standalone --non-interactive --agree-tos \
|
||||
-m "${ACME_EMAIL}" -d "${FQDN}"
|
||||
;;
|
||||
dns-01)
|
||||
echo "FATAL: certbot dns-01 needs a provider plugin; prefer ACME_CLIENT=acme.sh for Aliyun DNS." >&2
|
||||
exit 2 ;;
|
||||
*)
|
||||
echo "FATAL: ACME_METHOD must be http-01 or dns-01" >&2; exit 2 ;;
|
||||
esac
|
||||
install -m 644 "/etc/letsencrypt/live/${FQDN}/fullchain.pem" "${TLS_CERT_PATH}"
|
||||
install -m 600 "/etc/letsencrypt/live/${FQDN}/privkey.pem" "${TLS_KEY_PATH}"
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "FATAL: ACME_CLIENT must be acme.sh or certbot" >&2; exit 2 ;;
|
||||
esac
|
||||
|
||||
chmod 600 "${TLS_KEY_PATH}" || true
|
||||
chmod 644 "${TLS_CERT_PATH}" || true
|
||||
|
||||
cat <<SUMMARY
|
||||
|
||||
Installed:
|
||||
TLS_CERT_PATH = ${TLS_CERT_PATH}
|
||||
TLS_KEY_PATH = ${TLS_KEY_PATH}
|
||||
|
||||
RENEWAL (LE certs last ~90 days):
|
||||
- acme.sh installs its OWN cron on install ('acme.sh --cron'); --install-cert registered the
|
||||
reload hook above, so renewals auto-reload the data-plane. Verify: 'crontab -l | grep acme'.
|
||||
- certbot: add a cron/timer, e.g.
|
||||
0 3 * * * certbot renew --quiet --deploy-hook 'systemctl try-reload-or-restart relay-data-plane.service'
|
||||
- http-01 renewals need :80 reachable at renew time; dns-01 does not.
|
||||
SUMMARY
|
||||
Reference in New Issue
Block a user