MirrorMirror
/
funkwhale
mirror of https://dev.funkwhale.audio/funkwhale/funkwhale.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

docs: Instruct users to setup TLS using certbot 

Part-of: <https://dev.funkwhale.audio/funkwhale/funkwhale/-/merge_requests/2319>
This commit is contained in:
Georg Krause 2023-01-17 08:40:12 +01:00
parent 281b49e003
commit 28a328ca9d
1 changed files with 7 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
docs/administrator_documentation/installation_docs/debian.md
View File

@ -361,33 +361,19 @@ grep '${' /etc/nginx/sites-enabled/funkwhale.conf
## 10. Set up TLS ## 10. Set up TLS
To enable your users to connect to your pod securely, you need to set up {abbr}`TLS (Transport Layer Security)`. To do this, we recommend using the <acme.sh> script. To enable your users to connect to your pod securely, you need to set up {abbr}`TLS (Transport Layer Security)`. To do this, we recommend using certbot.
1. Create the `/etc/certs` folder to store the certificates. 1. Install certbot
```{code-block} sh ```{code-block} sh
sudo mkdir /etc/certs apt-get update
apt-get install certbot python3-certbot-nginx
``` ```
2. Download and run `acme.sh`. Replace `my@example.com` with your email address. 2. Run certbot
```{code-block} sh ```{code-block} sh
curl https://get.acme.sh | sudo sh -s email=my@example.com sudo certbot --nginx -d $FUNKWHALE_HOSTNAME
``` ```
3. Generate a certificate. Replace `example.com` with your Funkwhale pod name. Use `/srv/funkwhale/front` as your web root folder. That's it! certbot renews your certificate every 60 days, so you don't need to worry about renewing it.
```{code-block} sh
sudo acme.sh --issue -d example.com -w /srv/funkwhale/front
```
4. Install the certificate to your Nginx config. Replace `example.com` with your Funkwhale pod name.
```{code-block} sh
sudo acme.sh --install-cert -d example.com \
--key-file /etc/certs/key.pem \
--fullchain-file /etc/certs/cert.pem \
--reloadcmd "service nginx force-reload"
```
That's it! acme.sh renews your certificate every 60 days, so you don't need to about renewing it.