Ryan Malloy
c1afe77b27
Replaces the self-signed dev cert flow with a real LE prod cert for dns.l.supported.systems, issued and auto-renewed by a Caddy sidecar using DNS-01 challenge against the Vultr API. Components: - caddy/Dockerfile builds Caddy 2.10.0 with caddy-dns/vultr plugin via xcaddy. GOTOOLCHAIN=auto so xcaddy can fetch newer Go on demand when plugin versions advance their minimum Go. - caddy/Caddyfile uses DNS-01 with explicit public resolvers (1.1.1.1, 9.9.9.9) for the propagation check. Without that, Docker's embedded DNS leaks the container into the host's split-horizon LAN DNS, which returns LAN IPs for ns1.vultr.com and the propagation check fails. - docker-compose: caddy service shares ./caddy-data with coredns via a read-only subpath mount that excludes /acme (account private key). - Healthcheck doubles as a symlinker: maintains stable cert.pem / key.pem names at /data/caddy/ and chmods cert files + their dirs to be readable by CoreDNS's nonroot user. Flips to "healthy" only once the symlinks dereference (i.e. cert exists), gating CoreDNS start via depends_on: service_healthy. - Corefile unchanged — same /etc/coredns/certs/cert.pem path; only the bind-mount source switches from ./certs to ./caddy-data/caddy. - New Makefile target: tls-up orchestrates the bring-up sequence. Cert is valid until Aug 12 2026. Verified end-to-end: dig @127.0.0.1 -p 8853 +tls +tls-hostname=dns.l.supported.systems ... dig @127.0.0.1 -p 8443 +https +tls-hostname=dns.l.supported.systems ...
31 lines
1.1 KiB
Bash
31 lines
1.1 KiB
Bash
COMPOSE_PROJECT_NAME=coredns
|
|
|
|
# CoreDNS image pin — use a digest in real deploys
|
|
COREDNS_IMAGE=coredns/coredns:1.11.3
|
|
|
|
# Host ports. systemd-resolved usually binds 53, so default to 5353.
|
|
# Override to 53 if you actually want this to be the host's resolver.
|
|
DNS_PORT=1053
|
|
METRICS_PORT=9153
|
|
HEALTH_PORT=8080
|
|
|
|
# DoT (DNS-over-TLS, RFC 7858) — IANA port 853. Host port 8853 to
|
|
# stay unprivileged.
|
|
DOT_PORT=8853
|
|
|
|
# DoH (DNS-over-HTTPS, RFC 8484) — typically 443. Host port 8443
|
|
# because Caddy already owns 443 on this host.
|
|
DOH_PORT=8443
|
|
|
|
# --- Production cert provisioning (Caddy sidecar + Let's Encrypt) ---
|
|
# Hostname the cert is issued for. Must be a name you control and that
|
|
# resolves via the public DNS server holding the zone (Vultr's NS).
|
|
CADDY_HOSTNAME=dns.l.supported.systems
|
|
|
|
# Contact email registered with Let's Encrypt for expiry notifications.
|
|
ACME_EMAIL=rpm@malloys.us
|
|
|
|
# VULTR_API_KEY is intentionally NOT stored here. Caddy reads it from
|
|
# the shell environment via docker compose's variable interpolation —
|
|
# export it in your shell (or in ~/.zshenv) before `make tls-up`.
|