Could you provide a good reference for the process you describe, or maybe just a...

jsjohnst · on Nov 29, 2019

It’s an Ansible playbook for easily setting up a VPN with good security defaults. It’s so easy and really the only knowledge you need to know is how to get api keys for the provider of choice.

scarejunba · on Nov 29, 2019

https://www.digitalocean.com/community/tutorials/how-to-set-...

Their tutorials will hold your hand all the way to the end.

kizashi · on Nov 29, 2019

I think one of the interesting option out there is: https://github.com/StreisandEffect/streisand

Waiting for https://github.com/StreisandEffect/streisand/pull/1668 to be fixed though.

nitzle · on Dec 1, 2019

Hey, I wrote the PR you just linked (#1668). Was there an issue with the code changes you ran into? Just asking since you said you were waiting for it to be fixed. If so, I'd love to know what the error was so I can test/fix it. Or did you just mean the underlying issue (ACMEv1 protocol being deprecated)?

kizashi · on Dec 1, 2019

Hey, thanks for the fix. I was indeed able to spin off a Streisand server using it without any error <3!

nitzle · on Dec 6, 2019

Hey there, I found an issue in the PR recently that affects the auto-renewal process. Nginx will still serve the old certificate after renewal succeeds since it's never restarted or reloaded. I have another PR open to fix this, but there's a manual way to apply the fix if you're so inclined (and you still have that Streisand server up and running).

Obviously this only applies if you don't plan on destroying/recreating your Streisand server after the newer PR gets merged (EDIT--just got merged). But just in case, the steps are pretty easy (it's in the PR here too: https://github.com/StreisandEffect/streisand/pull/1688):

  [root@streisand]# cat > /etc/letsencrypt/renewal-hooks/deploy/01-reload-nginx.sh << EOF
  #!/bin/sh
  systemctl reload nginx
  EOF
  [root@streisand]# chmod u+x /etc/letsencrypt/renewal-hooks/deploy/01-reload-nginx.sh

If your cert was already auto-renewed (unlikely given the timeline), you'll also need to run systemctl reload nginx to serve the new cert, since the deploy script wasn't present when certbot ran the renewal.