38 lines
1.4 KiB
Markdown
38 lines
1.4 KiB
Markdown
|
# Apache SSL certificates
|
||
|
|
|
||
|
|
This directory is mounted into the container at `/etc/apache2/ssl` (see `docker-compose.yml`).
|
||
|
|
Drop your TLS cert/key here. The actual `.crt`/`.key`/`.pem` files are gitignored — only this README is tracked.
|
||
|
|
|
||
|
|
## Files expected by the vhost config
|
||
|
|
|
||
|
|
For `jumpers.stormcloudhills.com` (`docker/apache/000-default.conf`):
|
||
|
|
|
||
|
|
| File | Purpose |
|
||
|
|
| --- | --- |
|
||
|
|
| `jumpers.stormcloudhills.com.crt` | Server certificate (SSLCertificateFile) |
|
||
|
|
| `jumpers.stormcloudhills.com.key` | Private key (SSLCertificateKeyFile) |
|
||
|
|
| `jumpers.stormcloudhills.com.chain.crt` | Optional CA chain/bundle (uncomment SSLCertificateChainFile to use) |
|
||
|
|
|
||
|
|
## Option A — Let's Encrypt (recommended for production)
|
||
|
|
|
||
|
|
Issue a cert on the host with certbot, then copy/symlink it in:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
certbot certonly --standalone -d jumpers.stormcloudhills.com
|
||
|
|
cp /etc/letsencrypt/live/jumpers.stormcloudhills.com/fullchain.pem \
|
||
|
|
docker/apache/ssl/jumpers.stormcloudhills.com.crt
|
||
|
|
cp /etc/letsencrypt/live/jumpers.stormcloudhills.com/privkey.pem \
|
||
|
|
docker/apache/ssl/jumpers.stormcloudhills.com.key
|
||
|
|
```
|
||
|
|
|
||
|
|
Restart Apache after each renewal: `docker compose restart web`.
|
||
|
|
|
||
|
|
## Option B — Self-signed (local testing only; browsers will warn)
|
||
|
|
|
||
|
|
```sh
|
||
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||
|
|
-keyout docker/apache/ssl/jumpers.stormcloudhills.com.key \
|
||
|
|
-out docker/apache/ssl/jumpers.stormcloudhills.com.crt \
|
||
|
|
-subj "/CN=jumpers.stormcloudhills.com"
|
||
|
|
```
|